[CI/CD] Make the CI and release toolchain immutable and reproducible

[fettpl]

Summary

• Pin third-party GitHub Actions to verified immutable commits and pin the supported Node, Bun, runner, and release-tool versions.
• Use lock-backed, frozen installs for policy and release execution.
• Validate workflow/action references, lifecycle edges, container digests, filesystem boundaries, and required gate dependencies without network access.
• Preserve the exact tested revision and release dependency graph introduced by [CI/CD] Gate every release on the exact commit that passed CI #244.

Closes #230

Design

This branch is stacked directly on #244 and should merge after it. Mutable workflow inputs are replaced with exact identities, while the repository policy rejects unpinned or dynamically resolved execution paths before privileged consumers run. The release workflow retains #244's exact-checkout and tested-revision guarantees while using the pinned local semantic-release toolchain.

Validation

• Exact reviewed head: 17896afa176f39f9265821f4f751b391344a1a14.
• Independent P0/P1 review: approved with no blockers.
• Workflow-policy suite: 66/66 passed.
• npm run check: passed.
• Normal pre-push frontend quality/build hook: passed.
• GitHub CI and Security runs were created for the exact head and are action_required with no executable jobs, pending upstream workflow approval.

UI changes

None. The issue-specific change is CI and release tooling only.

Risks and rollout

• Merge [CI/CD] Gate every release on the exact commit that passed CI #244 first so this PR reduces to the immutable-toolchain change while retaining the validated release graph.
• Protected-branch review remains the trust boundary for edits to workflow bootstrap steps.
• Dependabot should be the normal update path for pinned action SHAs, with reviewers matching each SHA to the intended official release.

[fettpl]

@0xSero Exact independently reviewed head 17896af is ready, non-draft, and mergeable. Current-head CI (https://github.com/sybil-solutions/local-studio/actions/runs/29729720146) and Security (https://github.com/sybil-solutions/local-studio/actions/runs/29729720020) are action_required with zero executable jobs, pending upstream workflow approval; no genuine CI failure is present. Please approve the runs and review when convenient.