chore: SHA-pin GitHub Actions

[skonefal]

SHA-pin GitHub Actions to commit hashes.

[cursor]

PR Summary

Low Risk
CI-only reference changes with no dbt or runtime logic impact; behavior should match the same tagged action versions.

Overview
Pins third-party GitHub Actions in the dbt workflows (dbt_ci.yml, dbt_deploy.yml, dbt_prod.yml) from floating tags (@v4, @v5, @v6) to immutable commit SHAs, with the original version kept in comments.

Affected actions: actions/checkout, astral-sh/setup-uv, dawidd6/action-download-artifact, and actions/upload-artifact (deploy workflow only). Workflow steps and behavior are unchanged; only how those actions are resolved at run time is locked down for supply-chain consistency.

^{Reviewed by Cursor Bugbot for commit 9e0c79a. Configure here.}