Pin third-party GitHub Actions to immutable commit SHAs

Mutable version tags can be silently moved to malicious commits,
enabling supply chain attacks. Pin both third-party actions to their
current commit SHAs to prevent tag-move attacks.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>