GitHub Actions pinning rule should recognize actions.lock enforcement

[hyperpolymath]

Problem

Codacy reports a third-party GitHub Action as unpinned when the repository is
enforced by GitHub's actions.lock mechanism. The check appears to inspect the
literal uses: value without accounting for .github/workflows/actions.lock.

Reproduction

Public example: metadatastician/enaction-engine, PR #53, commit
692196676436c6cf87949925bc4b900085e288b5.

The Codacy check reports one new issue at .github/workflows/rust-ci.yml line
29:

An action sourced from a third-party repository on GitHub is not pinned to a
full length commit SHA. Pinning an action to a full length commit SHA is
currently the only way to use an action as an immutable release.

The source reference is:

- uses: dtolnay/rust-toolchain@v1

The repository's .github/workflows/actions.lock binds that exact reference:

'dtolnay/rust-toolchain@v1':
    ref: 'v1'
    commit: 'sha1-6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772'
    owner_id: 1940490
    repo_id: 260749683

The repository has GitHub's sha_pinning_required Actions setting enabled.
GitHub executes the locked commit, and the official github/gh-actions-lock
extension v0.1.6 verifies all 27 workflows:

$ gh actions-lock --verify --json=valid,findings
{"valid":true,"findings":[]}

A deliberately introduced unlocked action reference is detected by the same
verifier, providing a positive control.

Requested behavior

Please recognize a uses: reference as pinned when the exact workflow edge and
symbolic reference are covered by a valid .github/workflows/actions.lock
entry containing a full immutable commit and GitHub owner/repository identity.

The lockfile also covers immutable transitive dependencies of composite
actions. Rewriting to an inline SHA expresses less provenance and can cause an
Actions-lock-enforced workflow to fail admission, so inline rewriting is not an
equivalent remediation for this repository class.

If this server-side rule is maintained elsewhere, please transfer or route the
issue to the responsible analyzer rather than treating it as a CLI-only report.

Related evidence and owner ruling:
hyperpolymath/standards#674