security(ci): pin all GitHub Actions to commit SHAs (supply-chain hardening)

Mutable tag/branch refs (@v6, @release/v1) in workflows with id-token:write
(OIDC trusted publishing) are a supply-chain risk: a compromised or moved ref
could intercept the OIDC token and publish malicious packages to PyPI.

Pinned:
- actions/checkout@v6 -> d23441a (v6)
- actions/setup-python@v6 -> ece7cb0 (v6)
- pypa/gh-action-pypi-publish@release/v1 -> ba38be9 (v1.14.1)
- actions/checkout@v4 -> 11d5960 (v4)

Aligns with engraphis build-compiled-wheels.yml which already pins SHAs.
All YAML validated, ruff clean, 19/19 tests pass.

Author: Coding-Dev-Tools

.github/workflows/ci.yml

@@ -10,10 +10,10 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
 
     - name: Set up Python
-      uses: actions/setup-python@v6
+      uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
       with:
         python-version: "3.12"
 
@@ -33,10 +33,10 @@ jobs:
         python-version: ["3.10", "3.11", "3.12", "3.13"]
 
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
 
     - name: Set up Python ${{ matrix.python-version }}
-      uses: actions/setup-python@v6
+      uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
       with:
         python-version: ${{ matrix.python-version }}
 

.github/workflows/cowork-auto-pr.yml

@@ -16,7 +16,7 @@ jobs:
       # without this step every run failed with "not a git repository" and no
       # PR was ever opened (fleet-wide defect: 11/11 seeded copies lacked it).
       - name: Check out the pushed branch
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           ref: ${{ github.ref_name }}
           fetch-depth: 0

.github/workflows/publish.yml

@@ -13,10 +13,10 @@ jobs:
       id-token: write
 
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
 
     - name: Set up Python
-      uses: actions/setup-python@v6
+      uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
       with:
         python-version: '3.12'
 
@@ -32,4 +32,4 @@ jobs:
       run: twine check dist/*
 
     - name: Publish to PyPI
-      uses: pypa/gh-action-pypi-publish@release/v1
+      uses: pypa/gh-action-pypi-publish@ba38be9e461d3875417946c167d0b5f3d385a247 # v1.14.1

.github/workflows/release-audit.yml

@@ -11,10 +11,10 @@ jobs:
   audit:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
         with:
           python-version: "3.11"