* ci: update GitHub Actions to latest versions
Bump all workflow actions to their latest releases, including major
updates for checkout (v7), upload-artifact (v7), github-script (v9),
action-download-artifact (v21), and thollander comment action (v3).
* ci: pin third-party actions to commit SHAs
Keep official GitHub actions on version tags, but pin community
actions to immutable commit hashes for supply-chain safety.