fix: pin GitHub Actions to SHA for supply chain security

[apham0001]

Summary

• Pin all GitHub Actions uses: references to commit SHAs for supply chain security
• Original version tags preserved as inline comments for maintainability
• Mitigates supply chain attacks where a compromised tag could inject malicious code (ref: Trivy incident March 2026)

Changes

• All uses: owner/action@tag → uses: owner/action@SHA # tag
• No version changes, only pinning format

Test plan

• Verify CI workflows run successfully
• Confirm no action versions changed, only pinning format

[netlify]

✅ Deploy Preview for obol-docs ready!

Name	Link
🔨 Latest commit	6c3bf99
🔍 Latest deploy log	https://app.netlify.com/projects/obol-docs/deploys/69c2aa7c6452690008d47cbd
😎 Deploy Preview	https://deploy-preview-602--obol-docs.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[apham0001]

Closing — repo has not been active in 2026, limiting SHA pinning to actively maintained repos.