ci: pin third-party Actions to commit SHAs (CWE-829)

[GaltRanch]

Summary

Pin all third-party GitHub Actions in .github/workflows/ to immutable
40-character commit SHAs, addressing CWE-829: Inclusion of Functionality
from Untrusted Control Sphere.

Why

A third-party Action pinned to a mutable tag (@v5, @v4, @master,
etc.) executes whatever the upstream maintainer pushes to that tag at
workflow run time. A maintainer-account compromise or a malicious tag
rewrite causes the action to run attacker code with ${{ secrets.* }}
in scope.

The March 2025 tj-actions/changed-files supply-chain incident
(CVE-2025-30066) was
exactly this shape: 23,000+ workflows compromised because they used
@v45 instead of a SHA. GitHub's own hardening guidance explicitly
recommends SHA pinning for third-party Actions:
Security hardening for GitHub Actions — using third-party actions.

Changes

File	Action	Before	After
.github/workflows/build.yml:56	codecov/codecov-action	@v5	@<sha> # v5
.github/workflows/build.yml:152	codecov/codecov-action	@v4	@<sha> # v4
.github/workflows/build.yml:205	codecov/codecov-action	@v4	@<sha> # v4
.github/workflows/build.yml:238	codecov/codecov-action	@v4	@<sha> # v4
.github/workflows/cpp-linter.yml:17	DoozyX/clang-format-lint-action	@v0.15	@<sha> # v0.15
.github/workflows/cpp-linter.yml:26	stefanzweifel/git-auto-commit-action	@v5	@<sha> # v5

Each SHA was resolved via gh api repos/<owner>/<repo>/git/refs/tags/<tag>
against the tag that was previously in use. The human-readable version is
preserved as an inline comment so dependabot / human reviewers can still
see what version is pinned.

NASA actions (actions/*, github/*) are not touched because they're
GitHub-published and outside the third-party threat model.

Test plan

• CI workflows continue to run successfully against the pinned SHAs.
• Action behavior is identical (the SHAs resolved correspond to the
  tags previously in use; nothing functionally changes).
• Future Dependabot bumps will need to come as SHA bumps with version
  comment updates — this is the recommended posture.

Provenance

Discovered by Kulvex Code (KCode),
a deterministic SAST scanner. Pattern: cloud-006-gha-third-party-no-sha.

Per common AI-assist disclosure practice: AI tooling was used. Discovery
ran through KCode with deterministic regex+AST patterns and an LLM verifier
(Grok 4 Fast). Fix generation ran through KCode's agentic mode with Grok
4.2 reasoning + Claude Sonnet 4.5 fallback. Each SHA resolution was done
by gh api calls, not invented.

— Bruno Aiub · AstroLexis · Kulvex Code · contact@astrolexis.space