Harden GitHub Actions workflows: pinning, static analysis, enforcement

[Vaivaswat2244]

Tracking issue for the GHA hardening work started in #8620 and #9032. Split out
from #8674.

#8620 hardened our workflows manually, but nothing enforces it — that's how
continuous-release.yml landed later with floating tags. This issue tracks closing
that gap.

Scope

• Pin action refs to full SHAs — Pin GHA dependencies #9032 and harden GitHub Actions workflows #8620
• Keep pins fresh: dependabot.yml or pinact --update (needs a call on
  review load)
• Same treatment for v1

To discuss

• Static analysis in CI. @ulgens proposed zizmor (+ found it via pinact).
  Open questions: zizmor vs actionlint vs both, and CI step vs git hook. Worth
  its own thread below.

cc @limzykenneth @lirenjie95

[ulgens]

Small correction:

pinact is a CLI to edit GitHub Workflow and Composite action files and pin versions of Actions and Reusable Workflows. pinact can also update their versions and verify version annotations.

It helps to generate the hashes locally.

---

I can get this task assigned.