chore: constant-time cron secret compare, least-privilege CI token, single biome version

[deanrie]

Summary

Three small hardening items, no behaviour change for valid requests:

• cron-auth.ts: the cron secret was compared with !==, which short-circuits on the first differing byte. Switched to crypto.timingSafeEqual on equal-length buffers (length is checked first, since timingSafeEqual throws on mismatch). The header is read as ?? "" so a missing header still returns 401 instead of throwing.
• ci.yml: adds permissions: contents: read (the default token had write scopes the job never uses) and a concurrency group so a new push cancels the previous run on the same ref.
• Biome version: the root asked for ^2.4.15 while apps/cursor pinned 2.4.14, so bunx biome ci . could resolve a different binary locally than in CI. apps/cursor now uses 2.4.15 and bun.lock loses the duplicate 2.4.14 entry.

Verification

• bun install --frozen-lockfile: no changes.
• bun x biome ci .: 0 errors (the 5 warnings and 1 info are pre-existing).
• bun run typecheck in apps/cursor: clean.

[vercel]

@deanrie is attempting to deploy a commit to the Anysphere Team on Vercel.

A member of the Team first needs to authorize it.

[deanrie]

Superseded by #450, which carries this commit together with the other housekeeping change as one reviewable PR.