CD workflows: pin actions/checkout to @v4 instead of @master

## Summary

Our CD workflows pin GitHub Actions to the moving `@master` branch instead of a stable major-version tag like `@v4`. This means every workflow run silently picks up whatever HEAD of `actions/checkout` happens to be — there is no diff in this repo when that upstream branch changes, so a green PR yesterday can fail today for reasons we cannot see.

## Affected workflows

- `.github/workflows/cd_dev.yaml` — 2 occurrences of `actions/checkout@master`
- `.github/workflows/cd_prod.yaml` — 1 occurrence of `actions/checkout@master`

Our newer workflows (`sync_tinypen_shared_openapi.yaml`, `sync_tinypen_provider_contract.yaml`, `sync_external_contract_mirrors.yaml`, `contract-validation.yml`) already pin `actions/checkout@v4`, so the inconsistency is internal to this repo too.

## Why this matters

- **Reproducibility** — same YAML produces different behavior over time.
- **Supply-chain surface** — a malicious or accidental commit to `actions/checkout`'s master branch propagates to every run immediately.
- **Breaking changes** — when `actions/checkout@v5` ships, `@master` consumers get the breakage at the next run with no warning.
- **GitHub's own guidance** explicitly recommends pinning to a major version tag or a SHA. Major-version tags (`@v4`) still receive patch/security updates automatically.

## Cross-repo alignment

- RERUM v1 (`CenterForDigitalHumanities/rerum_server_nodejs`) already uses `@v4` across all CI/CD workflows.
- TPEN-services (`CenterForDigitalHumanities/TPEN-services`) has the same `@master` drift — tracked separately in a TPEN-services issue.

## Proposed fix

Normalize the two CD workflows to `actions/checkout@v4`. Small, contained sweep; no behavior changes expected.

## Acceptance criteria

- [ ] No `@master` references remain in `.github/workflows/`.
- [ ] All `actions/checkout` references in CD workflows pin to `@v4`.
- [ ] CI passes on the sweep PR.

## Out of scope

- Pinning to commit SHAs — first-party `actions/*` major-version tags are sufficient.
- TPEN-services cleanup — separate issue.