Pin GitHub Actions in workflows to commit SHAs

[PabloZaiden]

Summary

• Pinned GitHub Actions references to commit SHAs across PR checks, npm release, and reusable binary release workflows.
• Updated all affected workflow action usages without changing workflow behavior.

[Copilot]

Pull request overview

Pins third-party GitHub Actions in the repository’s CI/release workflows to immutable commit SHAs, improving supply-chain security while preserving existing workflow behavior.

Changes:

• Updated PR checks workflow to use SHA-pinned actions/checkout and oven-sh/setup-bun.
• Updated NPM release workflow to use SHA-pinned actions/checkout, oven-sh/setup-bun, and actions/setup-node.
• Updated reusable binary release workflow to use SHA-pinned actions/checkout, oven-sh/setup-bun, actions/upload-artifact, and actions/download-artifact.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
.github/workflows/reusable-binary-release.yml	Pinned checkout/bun setup and artifact upload/download actions to commit SHAs.
.github/workflows/release-npm-package.yml	Pinned checkout/bun/node setup actions to commit SHAs for NPM publishing.
.github/workflows/pr-checks.yml	Pinned checkout and bun setup actions to commit SHAs for PR validation.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.