chore(ci): pin all external actions to commit SHAs (PLATL-406)

[nielsn]

Summary

• Pin all third-party GitHub Actions to their commit SHAs for supply-chain security
• Each pinned action includes a version comment for readability (e.g., # v4)

Why

Mutable tag references (e.g., @v4) can be overwritten — pinning to commit SHAs ensures reproducible, tamper-resistant CI builds.

Test plan

• Verify all workflows still pass on this branch