fix: pin GitHub Actions to SHA for supply chain security

[apham0001]

Summary

• Pin all GitHub Actions uses: references to commit SHAs for supply chain security
• Original version tags preserved as inline comments for maintainability
• Mitigates supply chain attacks where a compromised tag could inject malicious code (ref: Trivy incident March 2026)

Changes

• All uses: owner/action@tag → uses: owner/action@SHA # tag
• No version changes, only pinning format

Test plan

• Verify CI workflows run successfully
• Confirm no action versions changed, only pinning format