fix(ci): drop harden-runner until actions.lock records it

.github/workflows/ci-health-sweep.yml

@@ -45,14 +45,6 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      # Egress allowlist (RE001): this job talks only to the GitHub API.
-      - name: Harden runner
-        uses: step-security/harden-runner@v2.22.2
-        with:
-          egress-policy: block
-          allowed-endpoints: >
-            api.github.com:443
-            github.com:443
       - uses: actions/checkout@v7.0.1
       - name: Run CI-health sweep
         env:

.github/workflows/dependabot-automerge.yml

@@ -62,14 +62,6 @@ jobs:
       pull-requests: write   # needed to approve
 
     steps:
-      # Egress allowlist (RE001): this job talks only to the GitHub API.
-      - name: Harden runner
-        uses: step-security/harden-runner@v2.22.2
-        with:
-          egress-policy: block
-          allowed-endpoints: >
-            api.github.com:443
-            github.com:443
       - name: Fetch Dependabot metadata
         id: meta
         uses: dependabot/fetch-metadata@v3.1.0

.github/workflows/roadmap-sync.yml

@@ -46,14 +46,6 @@ jobs:
       EXCLUDE: 'idaptik burble rattlescript vcl-ut'
       WINDOW_MIN: ${{ inputs.window_min || '45' }}   # look-back window (> cron interval for overlap)
     steps:
-      # Egress allowlist (RE001): this job talks only to the GitHub API.
-      - name: Harden runner
-        uses: step-security/harden-runner@v2.22.2
-        with:
-          egress-policy: block
-          allowed-endpoints: >
-            api.github.com:443
-            github.com:443
       - name: Mint App installation token
         id: app
         uses: actions/create-github-app-token@v3.3.0