security: SHA-pin the setup-cli action in generated workflows (pre-v1) #383

Code scanning reports 5 medium PinnedDependencies alerts (#48-#52): the generated orchestrate.yaml and promote.yaml reference stablekernel/cascade/.github/actions/setup-cli@v0.1.0 by version tag, not by commit SHA. actions/checkout is already SHA-pinned; local actions need no pin. Only the cross-repo setup-cli self-reference is unpinned.

The CLI-version-bump automation (the generator's getCLIRef and the fleet repin) must resolve the version tag to its commit SHA and emit setup-cli@<sha> # vX.Y.Z, with the version bump updating the SHA. The existing action-pins feature (pin_mode sha) covers third-party actions via a static table but not the dynamic setup-cli self-reference.

Pre-v1 hardening. Needs a generator change, a regenerate of cascade's own workflows, and an e2e scenario asserting the setup-cli ref is a 40-hex SHA with a version comment. Resolves all 5 alerts.