feat(ci): pin third-party GitHub Actions to commit SHAs

### Problem
`.github/workflows/*.yml` reference GitHub Actions by tag (e.g. `actions/checkout@v6`, `EndBug/add-and-commit@v10.0.0`, `googleapis/release-please-action@v5`, `amannn/action-semantic-pull-request@v6`, `dependabot/fetch-metadata@v3`). Tags are mutable: if a maintainer's account is compromised, or a tag is force-moved, the workflow silently runs different action code on the next run. Some of these workflows have write permissions on the repository (e.g. `update_snapshot.yml` has `contents: write` and installs from PR-controlled `pnpm-workspace.yaml`), so a swapped action can exfiltrate secrets or push malicious commits.

### Proposed solution
Pin all third-party GitHub Actions to full-length commit SHAs. Dependabot's `github-actions` updater already supports SHA pinning and will keep them current with monthly PRs. Keep the tag reference in a comment for readability. Example:

```yaml
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v6.0.0
```

First-party `actions/*` are lower risk (GitHub-controlled) but pinning them is cheap and removes the "which are trusted vs. not" judgement from the maintainer. Dependabot's group setting can bundle the SHA bumps into one PR per group.

### Evidence of general need
- OpenSSF Scorecards flags "Pinned-Dependencies" for exactly this reason
- The 2022 tj-actions/changed-files compromise was propagated via mutable tags across thousands of repositories

### Alternatives considered
- Rely on GitHub's `dependabot`/`renovate` policy alone — does not defend against tag movement between updater runs

Discovered in the v3 diff review (executor 06 finding F-CI-02).

Start by inventorying every `uses:` entry in `.github/workflows/*.yml`, including the write-enabled `update_snapshot.yml`, and identify each third-party action currently using a tag. Replace those references with full-length commit SHAs while retaining the version in a comment; done means all action references are SHA-pinned and the workflow YAML remains valid.

Written by the indexing model from the issue text.