SHA-pin the last three floating action refs (supersedes #550)

[Zyrtnin]

Supersedes #550.

Dependabot proposed actions/checkout@v4 → @v7 in mutation.yml. That is an improvement in version and a regression in posture: every other checkout in this repo is pinned to a full commit SHA, and merging it would have left two pinned to a movable tag.

Whoever controls a tag controls what executes in CI, with the repository checked out and the job's secrets in scope — which is what SHA pinning exists to prevent, and which this repo already runs Scorecard over.

Pinning them to the SHA the rest of the repo already uses gets the version bump and the consistency.

A third straggler

setup-python@v7, in the same file, was the last floating ref in the entire repository. It turned up only because fixing the two prompted a sweep for the whole set rather than the two the PR named.

before:  actions/checkout@v4      ×2      actions/setup-python@v7  ×1
after:   0 floating refs across .github/workflows/

The check is a test, not a script

Deliberately. This repo has already learned twice that a checker wired to nothing is not a checker — two mutation groups were added to scripts/mutation_groups.py and never to the CI matrix, and check_coverage_omissions.py sat as a taskipy task nothing invoked. The weakest link in detect is the wiring, and pytest tests/ runs in CI unconditionally, so a test has none to forget.

tests/test_workflow_actions_are_sha_pinned.py asserts:

1. no floating ref anywhere in .github/workflows/ (local ./ composite actions and docker:// refs excluded, with the reasons in the file);
2. one SHA per action across all workflows — two SHAs for one action means a bump landed in some lanes and not others, leaving a stale version running wherever nobody looked;
3. a guard-the-guard check that the glob matched some workflows at all, since a glob matching nothing passes every assertion after it.

Each of (1) and (2) was verified by its own plant. Worth noting: the first plant attempt silently did not land (wrong target string) and the suite stayed green — indistinguishable from a test that fails to catch. Re-planted against the real line before trusting either assertion.