Replace Slack notification action and harden action refs

[kvz]

Why

Reduce GitHub Actions supply-chain exposure by removing the third-party Slack notification action from the CI failure path.

What changed

• Replaces 8398a7/action-slack with a direct incoming-webhook curl step.
• Keeps notifications scoped to main-branch E2E failures.

Validation

• Ruby YAML parse for .github/workflows/ci.yml
• git diff --check

Additional action reference hardening included here:

• Updates GitHub-owned actions in touched workflows to current major tags.
• Pins retained third-party actions in touched workflows to reviewed commit SHAs, keeping version comments beside each SHA.