Pin third-party GitHub Actions to SHAs

[kvz]

Why:

Third-party GitHub Action tags can move after review. Pinning these references to full commit SHAs makes the workflow supply-chain input immutable and prepares the repo for stricter GitHub Actions allowlist policy.

What:

• Replaced floating third-party action refs with the commits they currently resolve to.
• Left first-party, GitHub-owned, and already SHA-pinned actions unchanged.

Changed workflows:

• .github/workflows/ci.yml
• .github/workflows/claude.yml
• .github/workflows/docker-mcp.yml
• .github/workflows/release.yml

Resolved refs:

• mxschmitt/action-tmate@v3 -> mxschmitt/action-tmate@35b54afac29c97fb54faba5b513f8fbd1882f113
• anthropics/claude-code-action@beta -> anthropics/claude-code-action@28f83620103c48a57093dcc2837eec89e036bb9f
• docker/build-push-action@v7 -> docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf
• docker/login-action@v4 -> docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee
• docker/setup-buildx-action@v4 -> docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5
• changesets/action@v1 -> changesets/action@a45c4d594aa4e2c509dc14a9f2b3b67ba3780d0d

Verification:

• git diff --check
• Ruby YAML parse for changed workflow files
• Confirmed replaced floating refs no longer appear in changed workflows