security: pin GitHub Actions in generated project workflows

[codeforester]

Parent: #214
Related: #234

Problem

The repository's threat model and CI policy require third-party actions to use immutable commit SHAs, and repository workflows satisfy that gate. However, base-bash init currently generates a consumer workflow using mutable tags:

uses: actions/checkout@v4
uses: mfinelli/setup-bats@v1

This exports a weaker supply-chain default to every newly scaffolded project.

Impact

A moved or compromised tag can change executable CI code without a consumer repository change. The generated "standard project" contradicts the framework's own pinned-action security contract.

Acceptance criteria

• Pin every generated GitHub Action to a full immutable commit SHA.
• Keep a human-readable version comment beside each pin.
• Extend the quality contract to validate generated workflow content, not only repository workflows.
• Document the process for reviewing and updating scaffold pins.
• Add or update scaffold idempotency tests and run ./tests/validate.sh.

Review validation

Reviewed at commit d064f426681f0e340ff4990ba0c9830084a5fe12. The repository quality gate reports five repository action pins as valid, but it does not inspect the generated workflow template.