Pin GitHub Actions dependencies to full commit SHAs

Confirmed finding

The three default-branch workflow files currently contain 24 external uses: references spanning 11 distinct action identities, and every one is referenced by a mutable tag (for example @v4, @v2, or @stable) rather than a full commit SHA.

This is a medium-severity supply-chain hardening gap. It is not evidence that any referenced action is compromised. GitHub's current secure-use guidance states that a full-length commit SHA is the only immutable action reference:
https://docs.github.com/en/actions/reference/security/secure-use#using-third-party-actions

The affected paths are:

• .github/workflows/ci.yml
• .github/workflows/rulab.yml
• .github/workflows/worldgraph.yml

PR #10's exact-head CI confirms these workflow paths are active, but a green run does not make mutable upstream tags immutable.

Acceptance criteria

• Pin every external action and reusable workflow to a verified 40-character commit SHA.
• Retain the human-readable release tag as an inline comment so Dependabot can maintain it.
• Set explicit least-privilege workflow or job permissions.
• Keep checkout credentials disabled unless a job demonstrably needs repository writes.
• Enable Dependabot updates for the github-actions ecosystem.
• Preserve the current publication hold and deployment authorization boundary.
• Re-run standard CI and RuLab validation on the exact candidate head with no skipped required gate.

No merge or deployment is authorized by this issue.

Review .github/workflows/ci.yml, .github/workflows/rulab.yml, and .github/workflows/worldgraph.yml to inventory the external actions and reusable workflows. Start by comparing each reference with GitHub's secure-use guidance, then run standard CI and RuLab validation on the exact candidate head. The work is done when all acceptance criteria are met without skipped required gates or changing the publication and deployment boundaries.