Pin GitHub Actions to full-length commit SHAs - #91

PR classified as community.

⚠️ Head commit is NOT signed by a trusted team member, so the full 3-approval requirement applies. (Head commit author danfiedler-msft is not a trusted signer.)

Tip: to earn the credit (−1 approval), the head commit must be signed by you with one of your own keys listed in security/trusted-signing-keys.csv. A "Verified" badge that GitHub adds to commits it creates on your behalf — web-editor edits, applied suggestions, Codespaces, API commits — does not count.

✅ Collaborator approvals: 3/3 (rzhao271, roblourens, joshspicer).

✅ No newly added runnable binary files.

✅ No protected engineering system files changed.