ci: pin workflow actions to immutable commit SHAs

[Visio-Vanitas]

Fixes #192

Summary

Pin all remote GitHub Actions used in .github/workflows/ci.yml, release.yml, and images.yml to immutable full 40-character commit SHAs with inline comments noting the upstream version.

Changes Made

• Updated actions/checkout, dtolnay/rust-toolchain, Swatinem/rust-cache, actions/setup-python, actions/setup-node, actions/upload-artifact, actions/download-artifact, EmbarkStudios/cargo-deny-action, jetli/wasm-pack-action, sigstore/cosign-installer, docker/setup-buildx-action, docker/login-action, and docker/build-push-action across the three workflows.
• Preserved toolchain configuration for dtolnay/rust-toolchain with explicit toolchain: stable input.
• Added upstream reference comments (# v4.2.2, # stable, # v2.7.7, etc.) alongside pinned SHAs.

Verification

• Validated YAML syntax across all modified workflow files.
• Verified test suites and repo script checks locally.

[github-actions]

Thanks for your first pull request to Sotto, and welcome.

Two things that trip up newcomers:

• Every commit needs a Signed-off-by line under the Developer Certificate of Origin - PRs with unsigned commits cannot be merged. Sign off with git commit -s; if your branch already has unsigned commits, run git rebase --signoff main and push again.
• Please run cargo fmt --all --check and cargo clippy --workspace --all-targets -- -D warnings before pushing, and add tests for new behaviour (cargo test --workspace runs the suite).

The full guide is in CONTRIBUTING.md - a maintainer will review shortly.

[Maxerns]

Thanks @Visio-Vanitas. I verified the pinned SHAs against upstream. They resolve to valid upstream commits, but there are a few corrections needed before merging.

1. Fix the duplicate with: blocks in release.yml

The dtolnay step currently has two with: blocks. Duplicate YAML keys are invalid: some parsers reject them, while permissive parsers may retain only the latter block and lose toolchain: stable.

Please combine the inputs:

with:
  toolchain: stable
  targets: ${{ matrix.target }}

The release workflow does not run on pull requests, so the normal PR checks won’t exercise this configuration. Please validate it explicitly after updating it.

2. Correct the version comments

10 of the 13 distinct action version comments do not match the pinned commits. For example, the setup-python SHA corresponds to v5.6.0, but its comment says v5.4.0.

Please check each comment against the upstream tag associated with its SHA.

3. Document the intentional sotto-action@v1 exception

The two getsotto/sotto-action@v1 references remain unpinned. The existing comment explains that this job intentionally tests the moving major tag, so keeping these references preserves that coverage.

Please document this exception to #192 in the PR description. The issue’s blanket pinning requirement overlooked this distinction.

4. Preserve the current checkout version

actions/checkout is pinned to v4.2.2, while the original @v4 currently resolves to v4.4.0:

11d5960a326750d5838078e36cf38b85af677262

Please use that SHA with the matching comment to avoid moving checkout back to an older version. It is also the pin already used in sotto-action.

5. Add upstream verification links

Please add upstream commit/tag links to the PR description, as requested in the acceptance criteria, so reviewers can verify the pins directly.

Happy to re-verify once these are updated.