ci: pin every third-party action to a full-length commit SHA

[sirtimid]

Consensys-Incorporated requires every action reference to name a commit. The policy took effect after the last CI change landed, so nothing has run green here since #1042 on 2026-09-03, and merging main does not help — main is broken the same way:

The action actions/checkout@v7 is not allowed in Consensys-Incorporated/ocap-kernel
because all actions must be pinned to a full-length commit SHA.

That is a setup-job failure, so it takes down every job referencing a tag before a step runs.

All 37 third-party references now name a commit, with the release in a trailing comment. No version changes: every SHA is what the tag it replaces resolves to today. Local ./.github/... references are exempt and untouched.

This does not turn CI green on its own

The policy resolves actions transitively, and the MetaMask composite actions we call reach mutable tags one layer down. Pinning the call site does not reach them:

The actions actions/checkout@v6 and actions/setup-node@v6 are not allowed in
Consensys-Incorporated/ocap-kernel because all actions must be pinned to a
full-length commit SHA.

So Check changelog, Lint (no code changes), and everything under Lint, build, and test still fail on this branch, which means All jobs pass stays red and this cannot merge as it stands. It is worth landing as a unit anyway: it is the half that is uncontroversial, mechanically verifiable, and needed under either resolution.

Two ways to finish, neither in scope here:

• Allow actions/* and MetaMask/* and drop the SHA requirement. The allow list alone does not help: GitHub applies the pinning policy to every action regardless of allow-list status — "this includes actions from your organization and actions authored by GitHub" — and the references that fail are already actions/*. Only reusable workflows are exempt from pinning.
• Own those steps locally, as ci: get CI running again #1043 does.

Separately, better-sqlite3 12.x aborts on Node 24.20 during teardown, so the test jobs will need #1043's bump to 13.0.3 before they pass even once the action policy is settled.

Checked

• No third-party uses: left unpinned, and none without a version comment
• Every SHA verified against its tag through the API, and against what the mutable tag it replaced resolves to now
• prettier --check clean across all workflow and action files

actionlint is not evidence for any of this: 1.6.25 discovers only .github/workflows.