chore: pin GitHub Actions to full-length commit SHAs

[github-actions]

Note

The pull request "chore: pin GitHub Actions to full-length commit SHAs" was created by @joshuarli but did not reference an issue. Therefore this issue was created for better visibility in external tools like Linear.

Summary

• Pin all GitHub Actions references in .github/ workflow files to full-length commit SHAs

Generated by devenv pin_gha.

🤖 Generated with Claude Code

[linear-code]

JS-1993