chore(ci): SHA-pin remaining audit and supply-chain actions

[cryptoxdog]

Summary

• Pin floating uses: tags in .github/workflows/audit.yml and supply-chain.yml to the current tag commit SHAs (CWE-1357 / CWE-353).
• Follow-up to chore(ci): compatible pin refresh + observability + attest #220, which already hash-pinned upload-artifact v7.0.1.

Pins (resolved from the live tags, not major bumps):

• actions/checkout@v6 → d23441a48e516b6c34aea4fa41551a30e30af803
• actions/setup-python@v7 → 5fda3b95a4ea91299a34e894583c3862153e4b97
• actions/github-script@v8 → ed597411d8f924073f98dfc5c65a23a2325f34cd
• github/codeql-action/upload-sarif@v4 → db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28

Test plan

• Workflow YAML still valid (Actions parses uses: SHA + version comment)
• Audit Harness and Supply Chain Security jobs start (same majors as before)
• Scanner no longer reports mutable-tag warnings on the cited lines

Made with Cursor

[github-actions]

✅ PR reviewable size is within recommended limits

[github-actions]

L9 Audit Harness Report

• Generated: 2026-08-21T15:31:41.793621+00:00
• Repo root: /home/runner/work/Cognitive.Engine.Graphs/Cognitive.Engine.Graphs
• Overall result: ✅ PASSED
• Exit code: 0

Step Results

Step	Status	Exit Code	Notes
Architecture Audit	✅ Passed	0
Spec Coverage	✅ Passed	0
Contract Wiring	✅ Passed	0

Architecture Audit Findings

Severity	Count
🔴 CRITICAL	0
🟠 HIGH	0
🟡 MEDIUM	25
🔵 LOW	0

See artifacts/audit_report.md for full details.

Spec Coverage

• ✅ Implemented: 37
• ⚠️ Partial: 9
• ❌ Missing: 0
• Total features: 46

Category	Implemented	Partial	Missing	Total
gates	10	0	0	10
scoring	7	0	0	7
v1.1_node	2	0	0	2
v1.1_edge	2	0	0	2
v1.1_action	0	2	0	2
v1.1_scoring	1	1	0	2
action_handler	0	6	0	6
gds_algorithm	5	0	0	5
research_pattern	10	0	0	10

See artifacts/coverage_report.md for full details.

Next Steps

All checks passed. Safe to merge.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud