[framework-best-practices] Pin legacy Claude workflow action dependency to immutable commit SHAs

## Framework / Library Best Practices Findings

### 1. Legacy Claude composite actions use a mutable branch ref instead of immutable action pins
**Library:** GitHub Actions workflow syntax (`uses:` references)

**Library feature:** Immutable pinning of third-party actions to full commit SHAs.

**Current code:** Multiple composite actions reference a mutable branch:
- `claude-workflows/base/action.yml:73`
- `claude-workflows/issue-triage/ro/action.yml:76`
- `claude-workflows/issue-triage/rwx/action.yml:76`
- `claude-workflows/pr-review/ro/action.yml:105`
- `claude-workflows/pr-review/rwx/action.yml:105`
- `claude-workflows/mention-in-issue/rwx/action.yml:76`
- `claude-workflows/mention-in-issue/rwxp/action.yml:76`
- `claude-workflows/mention-in-pr/rwx/action.yml:96`
- `claude-workflows/mention-in-pr/rwxp/action.yml:96`
- `claude-workflows/project-manager/ro/action.yml:78`
- `claude-workflows/generate-report/ro/action.yml:103`
- `claude-workflows/build-failure-github-actions/rwx/action.yml:68`
- `claude-workflows/build-failure-buildkite/rwx/action.yml:129`

Each location currently uses:
```yaml
uses: elastic/ai-github-claude-code-action@working-forks
```

**Simplification:** Replace the branch ref with immutable commit SHAs (and optionally annotate intended release tag/version in comments). This uses GitHub Actions’ native secure pinning pattern and removes mutable-reference drift/risk.

**Documentation:**
- https://docs.github.com/actions/security-guides/security-hardening-for-github-actions#using-third-party-actions

## Suggested Actions
- [ ] Replace `elastic/ai-github-claude-code-action@working-forks` with a full commit SHA in all 13 files listed above.
- [ ] Add a documented update process (for example in `claude-workflows/DEVELOPING.md`) describing how to bump the pinned SHA intentionally.
- [ ] Run repository lint/CI after pin updates to confirm legacy composite workflows still execute as expected.

> [!NOTE]
>
> 🔒 Integrity filter blocked 9 items
>
> The following items were blocked because they don't meet the GitHub integrity level.
>
> - [#336](https://github.com/elastic/ai-github-actions/issues/336) `search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - [#428](https://github.com/elastic/ai-github-actions/issues/428) `search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - [#436](https://github.com/elastic/ai-github-actions/issues/436) `search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - [#197](https://github.com/elastic/ai-github-actions/issues/197) `search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - [#63](https://github.com/elastic/ai-github-actions/issues/63) `search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - [#483](https://github.com/elastic/ai-github-actions/issues/483) `search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - [#95](https://github.com/elastic/ai-github-actions/issues/95) `search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - [#76](https://github.com/elastic/ai-github-actions/issues/76) `search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - [#25](https://github.com/elastic/ai-github-actions/issues/25) `search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
>
> To allow these resources, lower `min-integrity` in your GitHub frontmatter:
>
> ```yaml
> tools:
> github:
> min-integrity: approved # merged | approved | unapproved | none
> ```
>
>

---
[What is this?](https://ela.st/github-ai-tools) | [From workflow: Trigger Framework Best Practices](https://github.com/elastic/ai-github-actions/actions/runs/25112202661)

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.