Track GitHub Actions allowlist update for pinned actionlint tag

[mrlunchbox777]

Summary

static-checks.yaml now uses rhysd/actionlint@v1.7.12 because @v1 no longer resolves. Repos/orgs using "allow actions by version" may currently allow only @v1, which can block this workflow.

Required follow-up

• Update the GitHub Actions allowlist rule to permit rhysd/actionlint@v1.7.12 (or an equivalent approved pattern).
• Verify the actionlint job runs in CI after policy update.

Notes

This is an environment/policy update outside repository code and should be tracked alongside the workflow fix PR.

[mrlunchbox777]

Linked implementation PR: #337. Once merged, update Actions allowlist policy to permit and verify job runs.

[mrlunchbox777]

Correction: allowlist should permit rhysd/actionlint@v1.7.12, then verify the actionlint job runs in CI.