#33 Pin actions by commit sha and add CI guard

Summary

Pins every GitHub Action by commit sha, and adds a CI guard (scripts/check_immutable_refs.py + a Pinned refs workflow, plus make ci) that fails on tag-only or :latest references. Every pin was resolved and then independently re-verified against upstream (tag -> sha, upstream history, advisories, 7-day supply-chain cooldown with security-release exceptions); the repo has no Dockerfiles, so no image pins apply.

Changes

• Every GitHub Action pinned to a 40-character commit sha; the human-readable tag stays in a comment.
• dtolnay/rust-toolchain is pinned to a master commit, so each step now passes toolchain: stable explicitly.
• Security-driven bumps:
  • pypa/gh-action-pypi-publish release/v1 -> v1.14.3, which fixes the Critical GHSA-5xjx-3w67-w9x9.
  • lychee-app/lychee-action -> lycheeverse/lychee-action (the lychee-app org does not exist, a repojacking risk).
  • softprops/action-gh-release v2 (unsupported) -> v3.0.3 (inputs checked against v3's action.yml).
  • actions/upload-artifact v4 -> v7.0.2 and actions/download-artifact v4 -> v8.0.2 together (node20 EOL; v4 uploads are not readable by v8).
• scripts/check_immutable_refs.py fails on any mutable FROM, COPY --from, uses: or image: reference. Wired into make ci (lint_immutable_refs) and a new "Pinned refs" workflow.
• Pinned but not major-bumped (EOL, follow-up): astral-sh/setup-uv v6 (pinned to d0cc045d v6.8.0, not bumped)

Testing

• python3 scripts/check_immutable_refs.py exits 0
• make ci targets fmt, lint, test and lint_immutable_refs pass, as do all others except the two below
• audit: bun audit finds existing npm advisories; exits 1 identically on the unmodified default branch (checked with git stash)
• check_ai_writing: flags em dashes in existing Rust comments (crates/engine/src/gateway/client.rs, mod.rs, config.rs, crates/cli/src/gateway_cmd.rs); exits 1 identically on the unmodified default branch

Related Issues

None

---

Generated by Claude Code