fix(security): [LOW] pin GitHub Actions to immutable SHAs

[OskarEichler]

Summary

• Pins all 32 remote GitHub Action invocations to immutable full commit SHAs.
• Covers 10 actions across the linting, PR-title, publish, and end-to-end workflows.
• Retains version comments so future reviewed updates remain readable.

Security impact

The workflows currently trust mutable tags or a branch. If one of those references is retargeted after review, later workflow runs can execute different action code without any change in this repository. The required attacker position is strong—control of an upstream action reference—so this is marked LOW urgency, but pinning removes that avoidable supply-chain risk. No active compromise was found.

Verification

• Resolved every original action reference against its upstream repository.
• Confirmed all 32 remote uses: values are full 40-character SHAs after the change.
• Parsed all four changed workflow files as YAML.
• Ran git diff --check.
• Completed an independent patch review.

actionlint was not available in the local environment. Workflow triggers, permissions, inputs, and commands are otherwise unchanged.