chore(ci): pin agentrust-io/.github checkout to an immutable SHA (#68)

The contributor-check workflow runs on pull_request_target holding
issues: write and pull-requests: write, and checked out
agentrust-io/.github at `ref: main`. Anyone able to land a commit on
that repo's main therefore got a write-capable token in this repo. The
org action's own template comment says the ref must not be mutable.

Pinned to 0fe4520 (main as of 2026-08-01), which also carries the AGT
bump to 359a6b8 and its fail-closed UNKNOWN risk ordering, so errored
or rate-limited checks stop being scored as clean.

Author: imran-siddique

.github/workflows/contributor-check.yml

@@ -30,7 +30,10 @@ jobs:
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           repository: agentrust-io/.github
-          ref: main
+          # Pinned deliberately: this workflow runs on pull_request_target
+          # with a write-capable token, so the code it checks out must not
+          # track a mutable ref. Bump this SHA after reviewing the diff.
+          ref: 0fe4520ee71a743fcd33f409fe366ee3e1da6f86 # main as of 2026-08-01
           persist-credentials: false
           sparse-checkout: |
             scripts