chore: pin GitHub Actions to commit SHAs

[bolchowka]

SHA Pinning — automated PR

This PR pins all GitHub Actions workflow steps to immutable commit SHAs.

What changed

All mutable GitHub Actions tag references (e.g. @v3) have been replaced with immutable commit SHA pins plus a version comment, for example:

# before
- uses: actions/checkout@v4
# after
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

Dependabot will keep the SHA pins up-to-date – it's natively supported by GitHub.

Why

A mutable tag can be silently re-pointed to a malicious commit. SHA pins guarantee exactly which code runs in CI.
See: tj-actions/changed-files incident (March 2025)

Review checklist

• Spot-check a few SHA pins against the upstream action repo
• Verify CI still passes after merge
• Merge into v3.7