chore: update GitHub Action pins

[nikzen]

Summary

• Pin all external GitHub Actions in workflows to current upstream default-branch commit SHAs.
• Includes actions discovered from every uses: entry in .github/**/*.yml and .github/**/*.yaml.

Verification

• Commit is GPG-signed locally.
• CI on this PR should validate the updated action refs.

[github-actions]

* 031ed4538f52187cc229c299d049e0970ba76f24 chore: update GitHub Action pins
|   - Error: Could not find a certificate with BDE15DDCE302F9E417F426D9A575DDEB3DB7D052 in the policy file
* 89731fadda94d348c25348354a462a13576a0da3 fix: add libgcc to final image so that minijinja-cli actually works
    - Trust root.

Failed to authenticate commits.

Error: Could not verify commits 89731fadda94d348c25348354a462a13576a0da3..031ed4538f52187cc229c299d049e0970ba76f24

Caused by:
    0: While verifying commit 031ed4538f52187cc229c299d049e0970ba76f24
    1: Could not find a certificate with BDE15DDCE302F9E417F426D9A575DDEB3DB7D052 in the policy file