[sec-check] workflows use tag-pinned actions instead of SHA pinning (deploy-gh-pages, import-architectures, refresh-community-people)

## Security Finding

**Severity**: low
**Type**: unsafe-pattern / supply-chain hardening

Three of four workflows in this repo reference actions by mutable tag instead of an immutable commit SHA:

- `.github/workflows/deploy-gh-pages.yml` — `actions/checkout@v4`, `actions/setup-node@v4`, `actions/configure-pages@v5`, `actions/upload-pages-artifact@v3`, `actions/deploy-pages@v4`
- `.github/workflows/import-architectures.yml` — `actions/checkout@v4`, `actions/setup-node@v4`, `peter-evans/create-pull-request@v7` (runs with `contents: write` + `pull-requests: write`)
- `.github/workflows/refresh-community-people.yml` — same set, also `contents: write` + `pull-requests: write`

(`pdf.yml` already SHA-pins — good.)

Tags can be re-pointed by a compromised action maintainer or tag force-push, silently changing the code that runs with a write-capable `GITHUB_TOKEN`. The sibling repos firehose and bootc-ecosystem already SHA-pin all actions.

## Impact

A compromised upstream action tag would execute attacker code in workflows holding `contents: write`, `pull-requests: write`, `pages: write`, and `id-token: write` permissions — enabling repo tampering and malicious deployments to GitHub Pages.

## Recommendation

Pin every `uses:` to a full-length commit SHA with a version comment, e.g.:

```yaml
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
```

A fix PR from sec-check accompanies this issue.

---
*Filed by sec-check agent (ACMM L6 — full mode). Note: `security` label could not be applied — the Hive GitHub App installation lacks label-write permission on this repo.*