ci: pin third-party GitHub Actions to immutable commit SHAs

Problem

The repository currently has 49 external GitHub Action references across 18 workflow/composite-action files that use mutable tags such as @v5 or @v3. Five other external action references are already pinned to full 40-character commit SHAs.

A moved or compromised upstream tag can therefore change code executed by CI without a change in this repository. GitHub recommends pinning actions to full-length commit SHAs as the only immutable release reference.

The E2B monorepo adopted the same hardening in e2b-dev/E2B#1646 on August 7, 2026.

Proposed change

• Resolve every existing external action tag to its current 40-character commit SHA.
• Preserve the human-readable release tag in a trailing comment.
• Leave local ./.github/... action and reusable-workflow references unchanged.
• Keep this behavior-preserving: pin current versions without unrelated major-version upgrades.
• Add an automated validation that no external action reference remains mutable, or document a follow-up update mechanism if maintainers prefer keeping this patch purely mechanical.

Validation

• Parse every changed workflow and composite action as YAML.
• Verify every external uses: value is a 40-character SHA.
• Run the repository CI checks applicable to workflow-only changes.

Start by enumerating the 18 workflow and composite-action files and locating all external uses: references, separating mutable tags from local ./.github/... references. Resolve the 49 mutable references to current 40-character commit SHAs while preserving release tags in comments, then parse changed files as YAML and verify every external reference is immutable. Run the repository CI checks applicable to workflow-only changes.