[codex] Fix typos workflow trigger and pin action

[chrislearn]

Summary

• run the typos workflow on pushes to main
• add minimal contents: read workflow permissions
• pin crate-ci/typos to the v1.40.0 release commit instead of tracking master

Why

The workflow still targeted the old default branch name and followed a mutable action ref. That made the check easy to miss and unnecessarily increased supply-chain drift.

Impact

The typo check will run on the actual default branch again, and the action version is now explicit.

Validation

• reviewed the rendered workflow file locally
• verified the pinned release commit with git ls-remote https://github.com/crate-ci/typos refs/tags/v1.40.0
• remote GitHub Actions run will provide the execution check