ci: pin all GitHub Actions to full SHA digests

Pin every third-party GitHub Action to its current commit SHA with a
version comment, eliminating supply chain risk from mutable version
tags. Mutable tags (v4, v2, etc.) can be force-pushed by upstream
maintainers; SHA digests are immutable.

18 unique actions pinned across 9 workflow files.

Closes #357

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.github/workflows/labeler.yml

@@ -19,14 +19,14 @@ jobs:
         timeout-minutes: 10
         steps:
             - name: Apply path labels
-              uses: actions/labeler@v5
+              uses: actions/labeler@8558fd74291d67161a8a78ce36a881fa63b766a9 # v5
               continue-on-error: true
               with:
                   repo-token: ${{ secrets.GITHUB_TOKEN }}
                   sync-labels: true
 
             - name: Apply size/risk/module labels
-              uses: actions/github-script@v8
+              uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
               continue-on-error: true
               with:
                   script: |