fix: pin claude-code-action to commit SHA for security

[cfdude]

Summary

• Pins anthropics/claude-code-action from the mutable @v1 tag to the specific commit SHA 26ec041249acb0a944c0a47b6c0c13f05dbc5b44 (v1) in all affected workflow files
• This prevents supply-chain attacks where a compromised or updated tag could execute arbitrary code in CI

Files Updated

• .github/workflows/claude-code-review.yml
• .github/workflows/claude.yml

Change

- uses: anthropics/claude-code-action@v1
+ uses: anthropics/claude-code-action@26ec041249acb0a944c0a47b6c0c13f05dbc5b44  # v1

Test plan

• Verify workflows still trigger correctly after merge
• Confirm the pinned SHA resolves to the expected v1 release