ci: pin remaining workflow actions

[mstuart]

Summary

• pin every third-party action in .github/workflows/ci.yml to the full SHA currently behind its existing ref
• retain readable ref comments without upgrading action versions
• set the workflow token to read-only repository contents

This intentionally excludes security-audit.yml and release.yml, which are hardened in separate PRs.

Verification

• actionlint .github/workflows/ci.yml
• YAML parse and unpinned-action scan
• cargo fmt --package code-memory -- --check
• cargo clippy -- -D warnings
• cargo test (92 passed, 1 ignored)
• cargo build --all-targets
• cargo build --release
• npm ci --ignore-scripts --prefix npm
• npm run check --prefix npm
• npm package dry-run and installed CLI version smoke test
• git diff --check