Pin GitHub Actions dependencies to full commit SHAs #11

Confirmed finding

The three default-branch workflow files currently contain 24 external uses: references spanning 11 distinct action identities, and every one is referenced by a mutable tag (for example @v4, @v2, or @stable) rather than a full commit SHA.

This is a medium-severity supply-chain hardening gap. It is not evidence that any referenced action is compromised. GitHub's current secure-use guidance states that a full-length commit SHA is the only immutable action reference:
https://docs.github.com/en/actions/reference/security/secure-use#using-third-party-actions

The affected paths are:

• .github/workflows/ci.yml
• .github/workflows/rulab.yml
• .github/workflows/worldgraph.yml

PR #10's exact-head CI confirms these workflow paths are active, but a green run does not make mutable upstream tags immutable.

Acceptance criteria

• Pin every external action and reusable workflow to a verified 40-character commit SHA.
• Retain the human-readable release tag as an inline comment so Dependabot can maintain it.
• Set explicit least-privilege workflow or job permissions.
• Keep checkout credentials disabled unless a job demonstrably needs repository writes.
• Enable Dependabot updates for the github-actions ecosystem.
• Preserve the current publication hold and deployment authorization boundary.
• Re-run standard CI and RuLab validation on the exact candidate head with no skipped required gate.

No merge or deployment is authorized by this issue.