4 unpinned/mutable GitHub Actions tags in cargo-deny.yml, pr-smoke-test.yml, scorecard.yml

## Summary

Four `uses:` references across three workflow files still point at a mutable tag instead of a pinned commit SHA, which is inconsistent with the rest of the project's established convention: every other `uses:` line I checked in `.github/workflows/` is pinned to a full 40-character commit SHA with a `# vX.Y.Z` comment (e.g. the pattern used throughout `build-cli-linux.yml`, `ci.yml`, `goose-issue-solver.yml`, etc.).

A mutable tag (`@v7`, `@v7.0.1`) can be repointed to a different commit by the action's maintainer (intentionally, or as the result of a compromised account/token), silently changing what code runs in CI. A full commit SHA cannot be repointed. This is exactly what OpenSSF Scorecard's "Pinned-Dependencies" check looks for, and this repo already runs Scorecard (`.github/workflows/scorecard.yml`) — which is itself one of the affected files.

This is the same class of fix as #8812 ("chore: pin Swatinem/rust-cache to v2.9.1 SHA across all workflows"), for four references that were apparently missed or added afterward.

## Affected references (checked against `main` @ 5e90925)

| File | Line(s) | Current | Issue |
|---|---|---|---|
| `.github/workflows/cargo-deny.yml` | 25 | `actions/checkout@v7.0.1` | mutable tag, not a SHA |
| `.github/workflows/pr-smoke-test.yml` | 96 | `actions/setup-node@v7` | mutable major-version tag |
| `.github/workflows/pr-smoke-test.yml` | 130, 227 | `actions/setup-python@v7` | mutable major-version tag |
| `.github/workflows/scorecard.yml` | 76 | `github/codeql-action/upload-sarif@v4.37.8` | git tag, not a commit SHA (tags can be moved even when they look like an exact patch version) |

## Impact

Low in isolation — none of the four steps handle secrets directly today (`cargo-deny.yml` is `permissions: contents: read` and only runs on `push`/`schedule`/`workflow_dispatch`, never `pull_request`), so I'm not claiming this is an active exploit. It's a real gap in the project's otherwise consistent pinning discipline, and it's worth closing precisely because it's cheap to close and because `scorecard.yml` — the workflow whose entire purpose is supply-chain hardening — is one of the affected files.

Dependabot's `github-actions` ecosystem entry in `.github/dependabot.yml` won't self-heal this: it bumps a reference's version while preserving its existing format (confirmed by comparing merged dependabot PRs like #10539 "bump actions/setup-node from 6 to 7" against the still-unpinned `@v7` now on `main` — the tag format survived the bump unchanged).

## Suggested fix

Replace each with `owner/action@<40-char-sha> # vX.Y.Z`, matching the format already used everywhere else in `.github/workflows/`. Happy to open the PR once this reaches Ready, per CONTRIBUTING.md.