GitHub action: pinning the action to a SHA doesn't pin the installer or the CLI version

github/action.yml resolves both the installer script and the CLI binary at run time:

- name: Get opencode version
  run: VERSION=$(curl -sf .../releases/latest | ...)

- name: Install opencode
  run: curl -fsSL https://opencode.ai/install | bash

So pinning the action to a commit SHA only pins the composite wrapper — not anything that actually executes. The version resolved from the releases API is used solely as the actions/cache key and is never passed to the installer, so the install is always latest.

Two small changes would fix it:

• run the ./install that's already checked out at the pinned ref, instead of fetching it from opencode.ai
• add an optional version input passed to the installer as VERSION (the installer already reads it: requested_version=${VERSION:-})

Happy to send a PR — I have one working locally.