Pin third-party GitHub Actions to SHAs

[kvz]

Why:

Third-party GitHub Action tags can move after review. Pinning these references to full commit SHAs makes the workflow supply-chain input immutable and prepares the repo for stricter GitHub Actions allowlist policy.

What:

• Replaced floating third-party action refs with the commits they currently resolve to.
• Left first-party, GitHub-owned, and already SHA-pinned actions unchanged.

Changed workflows:

• .github/workflows/continuous-integration.yaml
• .github/workflows/pages.yml
• .github/workflows/release.yaml

Resolved refs:

• ruby/setup-ruby@v1 -> ruby/setup-ruby@afeafc3d1ab54a631816aba4c914a0081c12ff2f
• docker/build-push-action@v7 -> docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf
• docker/login-action@v4.2.0 -> docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee
• docker/metadata-action@v6.1.0 -> docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9
• docker/setup-buildx-action@v4.1.0 -> docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5

Verification:

• git diff --check
• Ruby YAML parse for changed workflow files
• Confirmed replaced floating refs no longer appear in changed workflows