v0.16.0 - Pinned starter workflow dependencies

Starter workflow supply-chain hardening

• Pin actions/checkout to the reviewed v7.0.1 commit SHA in every generated workflow.
• Keep all three downloadable Starter workflows byte-equivalent to agentic-init output.
• Add regression coverage that rejects a mutable checkout major tag.
• Document the immutable third-party pin and the deliberate moving @v0 project channel in English and Simplified Chinese.

Verification

• 145 deterministic tests pass.
• CI: https://github.com/lindixu6-hash/awesome-agentic-engineering/actions/runs/31986094274
• Pages deployment: https://github.com/lindixu6-hash/awesome-agentic-engineering/actions/runs/31986094253
• npm dry-run package: 369,398 bytes, 73 files; all six Starter files included.

This release improves dependency identity for newly generated consumer workflows. It does not prove that an Agent or third-party Action is generally safe. The project action remains on the documented moving @v0 channel unless a consumer chooses an immutable release tag or commit SHA.