chore: pin GitHub Actions to commit SHAs

[bolchowka]

SHA Pinning — automated PR

This PR pins all GitHub Actions workflow steps to immutable commit SHAs.

What changed

All mutable GitHub Actions tag references (e.g. @v3) have been replaced with immutable commit SHA pins plus a version comment, for example:

# before
- uses: actions/checkout@v4
# after
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

Dependabot will keep the SHA pins up-to-date – it's natively supported by GitHub.

Why

A mutable tag can be silently re-pointed to a malicious commit. SHA pins guarantee exactly which code runs in CI.
See: tj-actions/changed-files incident (March 2025)

Review checklist

• Spot-check a few SHA pins against the upstream action repo
• Verify CI still passes after merge
• Merge into master

⚠️ Actions requiring manual review

The following actions could not be pinned automatically and need manual attention:

Action	Location
pypa/gh-action-pypi-publish@release/v1	.github/workflows/publish-to-pypi.yml:53

These refs (e.g. @main, @master, @release/v1) could not be resolved to a commit SHA by pinact. Please pin them manually or add a comment justifying why they are left unpinned.