Refactor ResolveActionPin into focused resolution phases

[Copilot]

pkg/workflow and pkg/actionpins have significant long-function lint debt; this PR addresses the pkg/actionpins portion by reducing ResolveActionPin complexity without changing its external contract. The pin-resolution path is now split into explicit phases to make behavior easier to reason about and extend.

• What changed

  • Extracted dynamic resolver flow into tryDynamicActionResolution(...).
  • Extracted embedded pin fallback flow into resolveFromHardcodedPins(...).
  • Extracted unresolved/failure handling into resolveMissingActionPin(...).
  • Kept ResolveActionPin(...) as a compact orchestrator over those phases.

• Behavior preserved

  • Same resolution precedence: dynamic resolver (when available) → embedded pins → unresolved handling.
  • Same strict/non-strict fallback semantics.
  • Same warning dedup (ctx.Warnings) and resolution-failure recording behavior.
  • Same formatting paths (FormatPinnedActionReference / formatPinnedActionWithResolution) and SHA handling.

• Resulting structure

  • ResolveActionPin now delegates instead of inlining all branches, reducing line count and isolating responsibilities.

func ResolveActionPin(actionRepo, version string, ctx *PinContext) (string, error) {
    if resolved, ok := tryDynamicActionResolution(actionRepo, version, ctx, isAlreadySHA); ok {
        return resolved, nil
    }
    if resolved, ok := resolveFromHardcodedPins(actionRepo, version, ctx, isAlreadySHA, matchingPins); ok {
        return resolved, nil
    }
    return resolveMissingActionPin(actionRepo, version, ctx, isAlreadySHA)
}