chore(ci): pin third-party actions to commit SHAs in the 11 workflows that still float @v7 #1399

What

11 workflows still reference third-party actions by floating tag (@v7) while the rest of .github/workflows/ pins them to a full commit SHA with a version comment. 23 refs in total.

claude_code_review.yml          actions/checkout@v7  x3
client-python-ci.yml            actions/checkout@v7, actions/setup-python@v7
client-typescript-ci.yml        actions/checkout@v7, actions/setup-node@v7
publish-npm-caura-client.yml    actions/checkout@v7, actions/setup-node@v7
publish-npm-caura-sdk.yml       actions/checkout@v7, actions/setup-node@v7
publish-npm-client.yml          actions/checkout@v7, actions/setup-node@v7
publish-npm-sdk.yml             actions/checkout@v7, actions/setup-node@v7
publish-python-client.yml       actions/checkout@v7, actions/setup-python@v7
publish-python-metapackage.yml  actions/checkout@v7, actions/setup-python@v7
publish-python-sdk.yml          actions/checkout@v7, actions/setup-python@v7
verify-npm-credential.yml       actions/checkout@v7, actions/setup-node@v7

Why it matters

A tag is mutable. ci.yml, codeql.yml, dco.yml, labels-sync.yml, legacy-name-ratchet.yml, publish-docker.yml and security-scan.yml already pin, e.g.:

- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

The 7 unpinned publish-* workflows are exactly the ones that hold npm/PyPI publish credentials, so they are the ones where a retagged upstream action matters most. This is the pattern the repo already decided on — the gap is that these files were never brought along.

What to change

Replace each @v7 with the same SHA + # v7.x.y comment already used in ci.yml for that action. Reuse the exact SHAs from ci.yml / legacy-name-ratchet.yml so every workflow lands on one version:

• actions/checkout → 3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
• actions/setup-node → 820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
• actions/setup-python → 5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0

Dependabot's github-actions entry in .github/dependabot.yml already tracks these and understands SHA pins, so updates keep flowing.

How to verify

grep -rn "uses: [a-zA-Z].*@v[0-9]" .github/workflows/

Should print nothing after the change.

Scope

Config only, no code. One PR. Related: #1400 (persist-credentials: false) touches the same files — either order works, they don't conflict semantically but will conflict textually, so mention in your PR if you pick up both.

Filed unlabeled — the account that opened this lacks label-write permission. Intended labels: good-first-issue, help-wanted, kind/chore, area/infra, status/needs-triage.