Harden GitHub Actions workflows: pinning, static analysis, enforcement

[Vaivaswat2244]

Tracking issue for the GHA hardening work started in #8620 and #9032. Split out
from #8674.

#8620 hardened our workflows manually, but nothing enforces it — that's how
continuous-release.yml landed later with floating tags. This issue tracks closing
that gap.

Scope

• Pin action refs to full SHAs — Pin GHA dependencies #9032 and harden GitHub Actions workflows #8620
• Keep pins fresh: dependabot.yml or pinact --update (needs a call on
  review load)
• Same treatment for v1

To discuss

• Static analysis in CI. @ulgens proposed zizmor (+ found it via pinact).
  Open questions: zizmor vs actionlint vs both, and CI step vs git hook. Worth
  its own thread below.

cc @limzykenneth @lirenjie95