ci: pin third-party workflow actions

[enyst]

• A human has tested these changes.

---

Why

The OpenHands/extensions repo still had two third-party GitHub Actions referenced through mutable refs. This fixes the extensions-repo portion of OpenHands/OpenHands#14014 by pinning those actions to immutable commit SHAs while preserving human-readable version comments.

Summary

• Pin astral-sh/setup-uv@v7 in .github/workflows/tests.yml to 37802adc94f370d6bfd71619e3f0bf239e1f3b78.
• Pin pypa/gh-action-pypi-publish@release/v1 in .github/workflows/pypi-publish.yml to cef221092ed1bacb1cc03d23a2d87d1d172e277b (v1.14.0).
• Regenerate skills/openhands-sdk/SKILL.md and skills/index.js to satisfy existing CI sync checks on the current base.

Issue Number

OpenHands/OpenHands#14014 - extensions repo workflow-pinning portion. This PR intentionally does not close the broader org-wide tracking issue.

How to Test

• Scanned .github/workflows/*.yml for non-GitHub/non-OpenHands uses: refs that are not full 40-character SHAs; the scan found none after this change.
• Ran python scripts/sync_openhands_sdk_skill.py --check.
• Ran uv run --group test pytest tests/test_skills_catalog.py::TestGeneratedSkillsIndex::test_index_is_up_to_date -q.
• GitHub CI is green on the current PR head.

Video/Screenshots

N/A - CI workflow configuration and generated catalog updates only.

Notes

This PR was created by an AI agent (OpenHands) on behalf of the user.

[all-hands-bot]

👋 This PR needs a couple of things fixed before OpenHands can review it:

• the PR description's HUMAN: section needs at least 20 characters describing what you tested, not just the template placeholder

Push an update once this is addressed and this check re-runs automatically.

This is an automated check - no AI was used to generate this comment.

[all-hands-bot]

👋 This PR needs a couple of things fixed before OpenHands can review it:

• the PR description's HUMAN: section needs at least 20 characters describing what you tested, not just the template placeholder

Push an update once this is addressed and this check re-runs automatically.

This is an automated check - no AI was used to generate this comment.

[all-hands-bot]

👋 This PR needs a couple of things fixed before OpenHands can review it:

• the PR description's HUMAN: section needs at least 20 characters describing what you tested, not just the template placeholder

Push an update once this is addressed and this check re-runs automatically.

This is an automated check - no AI was used to generate this comment.

[all-hands-bot]

👋 This PR needs a couple of things fixed before OpenHands can review it:

• the PR description's HUMAN: section needs at least 20 characters describing what you tested, not just the template placeholder

Push an update once this is addressed and this check re-runs automatically.

This is an automated check - no AI was used to generate this comment.

[all-hands-bot]

👋 This PR needs a couple of things fixed before OpenHands can review it:

• the PR description's HUMAN: section needs at least 20 characters describing what you tested, not just the template placeholder

Push an update once this is addressed and this check re-runs automatically.

This is an automated check - no AI was used to generate this comment.