feat(ci): pin third-party GitHub Actions to commit SHAs

### Problem
`.github/workflows/*.yml` reference GitHub Actions by tag (e.g. `actions/checkout@v6`, `EndBug/add-and-commit@v10.0.0`, `googleapis/release-please-action@v5`, `amannn/action-semantic-pull-request@v6`, `dependabot/fetch-metadata@v3`). Tags are mutable: if a maintainer's account is compromised, or a tag is force-moved, the workflow silently runs different action code on the next run. Some of these workflows have write permissions on the repository (e.g. `update_snapshot.yml` has `contents: write` and installs from PR-controlled `pnpm-workspace.yaml`), so a swapped action can exfiltrate secrets or push malicious commits.

### Proposed solution
Pin all third-party GitHub Actions to full-length commit SHAs. Dependabot's `github-actions` updater already supports SHA pinning and will keep them current with monthly PRs. Keep the tag reference in a comment for readability. Example:

```yaml
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v6.0.0
```

First-party `actions/*` are lower risk (GitHub-controlled) but pinning them is cheap and removes the "which are trusted vs. not" judgement from the maintainer. Dependabot's group setting can bundle the SHA bumps into one PR per group.

### Evidence of general need
- OpenSSF Scorecards flags "Pinned-Dependencies" for exactly this reason
- The 2022 tj-actions/changed-files compromise was propagated via mutable tags across thousands of repositories

### Alternatives considered
- Rely on GitHub's `dependabot`/`renovate` policy alone — does not defend against tag movement between updater runs

Discovered in the v3 diff review (executor 06 finding F-CI-02).

Inizia facendo l'inventario di ogni voce `uses:` in `.github/workflows/*.yml`, incluso il file `update_snapshot.yml` abilitato alla scrittura, e identifica ogni action di terze parti che attualmente utilizza un tag. Sostituisci questi riferimenti con SHA di commit completi, mantenendo la versione in un commento; il lavoro è completato quando tutti i riferimenti alle action sono fissati a uno SHA e lo YAML del workflow rimane valido.

Scritto dal modello di indicizzazione a partire dal testo della issue.