workflow-action-pinning full commit SHAs

Trap: GitHub Action version tags such as actions/checkout@v6 look maintained and reproducible, but tags are mutable and let secret-bearing workflows execute changed third-party code without review. Fix: pin every local GitHub Action reference to its complete reviewed 40-character commit SHA, including checkout, setup-node, cache, and create-github-app-token; retain static contracts in workflow-action-pinning.js. Chose immutable SHAs over tags because privileged workflows expose Internal App and release tokens.