Workflow actions are tag-pinned, not SHA-pinned

[Christiantyemele]

Problem:

mutable tag on a third-party action = direct path to the deploy credential (tj-actions/changed-files class).

Fix: pin every third-party action to a full commit SHA (version in trailing comment).

• Tool: zizmor

AC:

• SHA-pin all third-party actions
• Add zizmor CI job