Evaluate pinning CI runner images instead of `-latest`

## Summary

Decide whether to pin the runner images (`ubuntu-24.04`, `macos-15`) instead of
tracking `ubuntu-latest` / `macos-latest`.

## Motivation

`ci.yml:25` matrixes `[ubuntu-latest, macos-latest]`, and `pre-commit.yml`,
`links.yml`, `ghc-matrix.yml`, and `release.yml` all run on `ubuntu-latest`.
When GitHub rolls `-latest` to a new image, the toolchain under a green build
changes with no commit in this repo, and the resulting failure lands on whatever
unrelated PR happens to be open. For a library whose CI value comes from
building the sdist against published bounds on a known toolchain, that is a real
source of unattributable red.

The tradeoff cuts both ways. `-latest` migrates for free and keeps the matrix
honest about what a current consumer builds on; a pin gives reproducibility but
goes stale, and Renovate does not track `runs-on:` labels out of the box, so
bumping it means hand edits or a custom manager. alunduil-chezmoi pins
`ubuntu-24.04`; the sibling Haskell repos do not.

This is a judgment call, not a defect — hence evaluate rather than change.

## Scope

- Decide pin versus `-latest`, and record the reasoning.
- If pinning: update the five workflows and add a Renovate custom manager (or
accept manual bumps and say so).
- If not: close with the rationale so the question does not resurface.

## Acceptance criteria

- [ ] A decision is recorded on this issue.
- [ ] If pinned, every workflow names an explicit image and the bump path is
documented or automated.

## Additional context

Surfaced by a CI and checks audit. Weighs more if unattended merges are ever
enabled, since a runner migration would then be merging against a moving
baseline.