[dependabot:release-train-updater] Pin unpinned GitHub Actions to commit SHAs in gh-aw-workshop

**Action:** Maintainer of `githubnext/gh-aw-workshop` should review the attached review-bundle artifact and open a PR there (or assign to Copilot with the prompt below). Acceptance check: `no-see-also.yml`, `image-link-check.yml`, and `delete-stale-copilot-branches.yml` use commit-SHA-pinned `actions/checkout` and `actions/github-script` refs, matching the rest of the repo's workflows.

### Summary
Found 3 workflow files in `githubnext/gh-aw-workshop` (target repo, `target/` checkout) still using mutable major-version tags instead of pinned commit SHAs, inconsistent with every other workflow in that repository:

| File | Old ref | New ref |
|---|---|---|
| `.github/workflows/no-see-also.yml` | `actions/checkout@v6` | `actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6` |
| `.github/workflows/no-see-also.yml` (x2) | `actions/github-script@v8` | `actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8` |
| `.github/workflows/image-link-check.yml` | `actions/checkout@v6` | `actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6` |
| `.github/workflows/image-link-check.yml` (x2) | `actions/github-script@v8` | `actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8` |
| `.github/workflows/delete-stale-copilot-branches.yml` | `actions/github-script@v8` | `actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8` |

No version bump — same v6/v8 releases, only converted to immutable SHA pins with version comments, as already done for `actions/checkout` and `actions/github-script` in `markdown-lint.yml`, `svg-contrast-check.yml`, `deploy-pages.yml`, `agentics-maintenance.yml`, and `copilot-setup-steps.yml` in the same repo.

### Why this is a review bundle, not a direct PR
This workflow runs in `review` mode for target repo `githubnext/gh-aw-workshop`. A full review bundle (patched files, summary, validation notes) was published as a workflow artifact via `publish_review_bundle` (bundle: `gha-pin-actions`) rather than opening a live PR against the target repository.

Risk / validation

- Risk: low — no behavior change, only SHA-pinning existing tag references.
- Confidence: high. Verified both commit SHAs against the GitHub tags API for `actions/checkout@v6` and `actions/github-script@v8`.
- Scope: CI-only, no application code, no auth/crypto/payment/db.
- No package manifests/lockfiles in `githubnext/gh-aw-workshop` required updates (`package-lock.json` has zero dependencies).
- Not run: actual CI execution (no local Actions runner available); diff is limited to `uses:` lines.
- Smart-Dependabot-Merge-Candidate: yes

Agent prompt

Update `.github/workflows/no-see-also.yml`, `.github/workflows/image-link-check.yml`, and `.github/workflows/delete-stale-copilot-branches.yml` in `githubnext/gh-aw-workshop` to pin `actions/checkout@v6` to `actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6` and `actions/github-script@v8` to `actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8` (all occurrences). Do not change any other workflow logic. Open a PR with these changes only.

### Control Plane
- Correlation ID: 33873310314-39
- Central repo: githubnext/gh-aw-cao
- Run URL: https://github.com/githubnext/gh-aw-cao/actions/runs/33873310314
- Target repo (untrusted, plain text): `githubnext/gh-aw-workshop`

> Generated by [:dependabot: Dependabot / Release Trains](https://github.com/githubnext/gh-aw-cao/actions/runs/33873749638) · copilot · auto · 48.6 AIC · ⌖ 6.21 AIC · ⊞ 20.5K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fdependabot-release-train-updater%22&type=issues)
>

_{Add this agentic workflow to your repo}

To install this agentic workflow, run

```
gh aw add githubnext/gh-aw-cao/.github/workflows/dependabot-release-train-updater.md@main
```

> - [x] expires on Sep 18, 2026, 12:44 PM UTC

In the target repository, inspect .github/workflows/no-see-also.yml, .github/workflows/image-link-check.yml, and .github/workflows/delete-stale-copilot-branches.yml, comparing their action references with the already pinned workflows named in the issue. Update all listed checkout and github-script uses only, then verify every occurrence uses the specified commit SHA with its version comment; no application code or dependency files need changes.

Written by the indexing model from the issue text.