[product-manager-impersonator] Immutable pinning mode for quick setup triggers

## Feature Idea

**Summary:** Add an opt-in quick-setup mode that rewrites downloaded trigger `uses:` references from floating `@v0` to immutable commit SHAs.

## Why a Customer Would Want This
Teams adopting these workflows in production often need stronger supply-chain controls and reproducibility than floating tags provide. An explicit immutable mode lets security-conscious users keep the current easy default while offering a hardened path for regulated or high-assurance environments.

## Rough Implementation Sketch
- Add a `--pin-sha` (or `--immutable-ref`) option in `scripts/quick-setup.sh`.
- Resolve the target release ref (default `v0`, or future explicit tag input) to a commit SHA once.
- After downloading each `trigger-*.yml`, rewrite `uses: elastic/ai-github-actions/...`@v0`` to `@`.
- Print pinned refs in normal and `--dry-run` output, and document the option in README/docs.

## Why It Won't Be That Hard
The setup flow already centralizes all trigger downloads in one loop and already supports dry-run messaging, so this can be implemented as a small post-processing step in one script plus docs updates. No workflow compiler or architecture changes are required.

## Evidence
- Security guidance already recommends considering SHA pinning for production: `docs/security.md` L10
https://github.com/elastic/ai-github-actions/blob/main/docs/security.md#L10
- Current quick setup has no pinning option in help and options: `scripts/quick-setup.sh` L22-L29
https://github.com/elastic/ai-github-actions/blob/main/scripts/quick-setup.sh#L22-L29
- Quick setup currently downloads from floating `v0` source: `scripts/quick-setup.sh` L114
https://github.com/elastic/ai-github-actions/blob/main/scripts/quick-setup.sh#L114
- Downloaded triggers are written as-is: `scripts/quick-setup.sh` L190-L196
https://github.com/elastic/ai-github-actions/blob/main/scripts/quick-setup.sh#L190-L196
- Example triggers currently use floating major tags (e.g. PR review): `gh-agent-workflows/pr-review/example.yml` L18
https://github.com/elastic/ai-github-actions/blob/main/gh-agent-workflows/pr-review/example.yml#L18
- Release docs explicitly distinguish floating vs exact refs (`@v0` vs exact release), which aligns with adding an immutable option: `docs/release.md` L7
https://github.com/elastic/ai-github-actions/blob/main/docs/release.md#L7

## Suggested Actions
- [ ] Add a `--pin-sha`/`--immutable-ref` option to `scripts/quick-setup.sh`.
- [ ] Implement `uses:` ref rewrite to pinned SHA for downloaded trigger files when enabled.
- [ ] Update docs and quick-setup usage examples to show when to choose floating vs pinned mode.

## Duplicate-check Notes
I checked prior Product Manager Impersonator findings in `/tmp/previous-findings.json`, including nearby items such as #409 (add `--ref` targeting), #1667 (atomic preflight), #809 (permission preflight), #769 (postflight verifier), #720 (bundle consistency), and #1262 (auto-stash mode). None propose immutable SHA pinning of generated trigger `uses:` refs.

---
[What is this?](https://ela.st/github-ai-tools) | [From workflow: Trigger Product Manager Impersonator](https://github.com/elastic/ai-github-actions/actions/runs/31169461924)

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

Start with scripts/quick-setup.sh, especially its option handling, dry-run messaging, download loop, and trigger-writing section. Then read docs/security.md and docs/release.md for the intended distinction between floating and exact refs. Done means an opt-in pinning mode rewrites downloaded trigger references, reports pinned refs in normal and dry-run output, and is documented in the README or docs.

Written by the indexing model from the issue text.