[DEV-72] chore: pin GitHub Actions to commit SHAs

[austinpray-mixpanel]

Summary

Pin all GitHub Actions workflow steps to immutable full commit SHAs instead of mutable tags or branches.

Why

Mutable tags can be moved after the fact, making it possible for a supply-chain attack to inject malicious code into CI. Pinning to a commit SHA ensures the exact version of an action is used, and the original tag is preserved as an inline comment for readability.

Verification

Review the diff — all uses: lines with third-party actions should now reference a 40-character commit SHA with the original tag as an inline comment.

🤖 Generated with Claude Code

Linear: https://linear.app/mixpanel/issue/DEV-72/pin-all-github-actions-to-commit-shas

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 96.29%. Comparing base (a3020d2) to head (853b8a5).

Additional details and impacted files

@@           Coverage Diff           @@
##           master     #133   +/-   ##
=======================================
  Coverage   96.29%   96.29%           
=======================================
  Files          12       12           
  Lines         567      567           
=======================================
  Hits          546      546           
  Misses         21       21           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[linear]

DEV-72 Pin all GitHub Actions to commit SHAs