Clean up CI workflows and remove stale rollup override

[obiot]

Summary

• Upgrade actions/cache from v4 to v5 across all workflows (docs, main, test)
• Add explicit permissions: { contents: read } to test.yml and main.yml (resolves CodeQL code-scanning alerts)
• Remove dead rollup override from package.json (rollup is no longer in the dependency tree)

Test plan

• pnpm install succeeds without rollup override
• pnpm build succeeds
• CI passes with updated actions

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR updates the repository’s CI workflows (cache action version + explicit token permissions) and removes a stale Rollup pin from the root pnpm overrides, aiming to reduce CodeQL alerts and simplify dependency constraints.

Changes:

• Bump actions/cache from v4 to v5 in docs/main/test workflows.
• Add explicit permissions: contents: read to main.yml and test.yml.
• Remove the root pnpm.overrides entry that pinned Rollup.

Reviewed changes

Copilot reviewed 4 out of 5 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
pnpm-lock.yaml	Intended to drop the Rollup override from lockfile overrides (but currently still present).
package.json	Removes the Rollup override from pnpm.overrides.
.github/workflows/test.yml	Adds explicit minimal permissions and upgrades cache action to v5.
.github/workflows/main.yml	Adds explicit minimal permissions and upgrades cache action to v5.
.github/workflows/docs.yml	Upgrades cache action to v5.

Files not reviewed (1)

• pnpm-lock.yaml: Language not supported

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.