fix(ci): pin FlakeHub workflow actions and fix tag checkout

[robcohen]

Summary

• Pin all GitHub Actions to commit SHAs for security (actions/checkout, DeterminateSystems actions)
• Fix checkout ref: use github.ref as fallback instead of empty string when triggered by tag push
• Fix tag parameter: use github.ref_name as fallback instead of null when triggered by tag push

The workflow was broken for tag-triggered runs because:

1. inputs.tag is only set for workflow_dispatch, not for push events
2. Without proper fallbacks, the checkout would use an empty ref and the flakehub-push would get a null tag

🤖 Generated with Claude Code