chore: pin GitHub Actions and Docker images to digests

[hhvrc]

Automated dependency pinning by the HeavenVR maintenance bot:

• GitHub Actions uses: refs upgraded to their latest release tag and pinned to the commit SHA that tag resolves to
• Dockerfile FROM images pinned to their current @sha256 digest

---

[stage-review]

Ready to review this PR? Stage has broken it down into 2 individual chapters for you:

	Title
1	Pin GitHub Actions in CI workflow
2	Pin GitHub Actions in publish workflow

_{Chapters generated by Stage for commit e3dd356 on Jul 28, 2026 9:08am UTC.}