ci: pin third-party actions to commit SHAs and let Dependabot track them #88

Why it matters
The three workflows reference actions/checkout@v7, actions/setup-node@v7, actions/upload-pages-artifact@v5 and actions/deploy-pages@v5 by mutable tag. A compromised or force-moved tag would run arbitrary code in a job that has pages: write and id-token: write (deploy) or issues: write (link check). The repo's Actions settings report sha_pinning_required: false. Defensive hygiene, not a live vulnerability: these are first-party GitHub actions, so the risk is low and the fix is cheap.

Evidence

• Every uses: line in .github/workflows/ci.yml, links.yml, pages.yml.
• .github/dependabot.yml already watches github-actions monthly, so pinned SHAs still get update PRs with the version in a trailing comment.

Suggested approach
Replace each tag with the full commit SHA of the current release and keep the tag as a comment (uses: actions/checkout@<sha> # v7.x). Optionally enable "Require actions to be pinned to a full-length commit SHA" under Settings → Actions so a later PR cannot regress it.

Done when
All uses: lines carry a SHA, CI is green, and Dependabot's next run opens an update PR against the SHA form.