Update action versions in pr-preview.yml

[dacoburn]

GitHub Actions workflows were failing due to unpinned action references. The security policy requires all actions to be pinned to full-length commit SHAs, but the workflows were using semantic version tags (e.g., @v4, @v5).

Root Cause

Actions were referenced using semantic version tags (actions/checkout@v4, actions/setup-python@v5, etc.) instead of full commit SHAs. Additionally, inline comments containing @vX.X.X patterns were being detected by the security scanner as unpinned action references, even though the actual action uses were correctly pinned.

Fix

• Pinned all GitHub Actions to full-length commit SHAs:
  • actions/checkout@v4 → eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871
  • actions/setup-python@v5 → f677139bbe7f9c59b41e40162b753c062f5d49a3
  • pypa/gh-action-pypi-publish@v1.12.4 → 67339c736fd9354cd4f8cb0b744f2b82a74b5c70
  • actions/github-script@v7 → 60a0d83039c74a4aee543508d2ffcb1c3799cdea
• Reformatted inline comments to avoid @vX.X.X pattern detection (e.g., # checkout v4.2.1 instead of # v4.2.1)

Public Changelog

N/A