[dependabot:release-train-updater] Pin actions/checkout@v6 and actions/github-script@v8 to release SHAs in gh-aw-workshop

**Action:** Maintainer of `githubnext/gh-aw-workshop`: review the attached review bundle artifact and, if satisfied, open the PR manually (or re-run this worker in `live` mode) to apply the 3-file pin update. Acceptance check: CI passes on the resulting PR and no workflow behavior changes besides the `uses:` refs.

Review-mode dependency finding for target repository `githubnext/gh-aw-workshop` (this workflow runs in `review` mode, so no code was pushed there — see the published review-bundle artifact `actions-pin-v6-v8` on this run for the full diff/patches).

### What changed
- Ecosystem: GitHub Actions
- Manifests: `.github/workflows/image-link-check.yml`, `.github/workflows/no-see-also.yml`, `.github/workflows/delete-stale-copilot-branches.yml`
- `actions/checkout@v6` → `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1`
- `actions/github-script@v8` → `actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0`

### Why now
Every other workflow in `gh-aw-workshop` (and its `.github/aw/actions-lock.json`) already pins Actions to an immutable commit SHA with a `# vX.Y.Z` comment. These 3 files were the only ones left using floating major-version tags (`@v6`, `@v8`), which is a supply-chain consistency/freshness gap — floating tags can be repointed without review.

### Risk assessment
- CI-only scope, no application runtime impact.
- `actions/github-script` v8→v9 has one documented breaking change: removal of `require('@actions/github')` support and `getOctokit` becoming an injected parameter. Checked all 3 affected scripts — none use either pattern, so the major bump is safe here.
- Update type: minor (checkout) + major (github-script), both low risk given the above.

### Validation
- `python3 yaml.safe_load()` confirms all 3 modified files remain valid YAML.
- Searched all 3 scripts for `require('@actions/github')` / `getOctokit` redeclaration: none found.
- No local Actions runner available in this sandbox to execute the workflows end-to-end; recommend confirming via normal CI once a PR is opened.

### Control Plane
- Correlation ID: 33900254806-157
- Central repo: githubnext/gh-aw-cao
- Run URL: https://github.com/githubnext/gh-aw-cao/actions/runs/33900254806

Smart-Dependabot-Merge-Candidate: yes (low risk, high confidence, no source migration needed)

Agent prompt

```
Apply the following pin updates in githubnext/gh-aw-workshop and open a PR:
1. In .github/workflows/image-link-check.yml: replace `uses: actions/checkout@v6` with `uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1`, and replace both occurrences of `uses: actions/github-script@v8` with `uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0`.
2. In .github/workflows/no-see-also.yml: apply the same two replacements.
3. In .github/workflows/delete-stale-copilot-branches.yml: replace `uses: actions/github-script@v8` with `uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0`.
Do not change any other line. Verify the resulting YAML is valid and open a PR titled "Pin actions/checkout and actions/github-script to release SHAs".
```

> Generated by [:dependabot: Dependabot / Release Trains](https://github.com/githubnext/gh-aw-cao/actions/runs/33900254806) · copilot · auto · 67.2 AIC · ⌖ 3.43 AIC · ⊞ 20.5K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fdependabot-release-train-updater%22&type=issues)
>

_{Add this agentic workflow to your repo}

To install this agentic workflow, run

```
gh aw add githubnext/gh-aw-cao/.github/workflows/dependabot-release-train-updater.md@main
```

> - [x] expires on Sep 18, 2026, 5:32 PM UTC

Start with .github/workflows/image-link-check.yml, .github/workflows/no-see-also.yml, and .github/workflows/delete-stale-copilot-branches.yml, reviewing the existing uses references and affected scripts. Apply only the specified SHA pins, validate all three files as YAML, and confirm CI passes on the resulting pull request with no workflow behavior changes.

Written by the indexing model from the issue text.