fix(actions): use official trunk-io actions for installation and checks

[Copilot]

Addresses security concern from review feedback about downloading unverified scripts during Trunk installation.

Changes:

• Replace curl -fsSL https://get.trunk.io | bash with trunk-io/trunk-action/setup@v1 for verified installation
• Use trunk-io/trunk-action@v1 for checks to enable native GitHub PR annotations
• Move permissions to job level (checks: write, contents: write) for proper scoping

# Before
- name: Install Trunk
  run: |
    curl -fsSL https://get.trunk.io -o- | bash
    echo "$HOME/.trunk/bin" >> $GITHUB_PATH

# After  
- name: Install Trunk
  uses: trunk-io/trunk-action/setup@v1

Maintains autofix functionality via trunk fmt . followed by the action-based check step.

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.