Move to commit SHAs for .github/workflows actions

apple/app-store-server-library-java#258 mergedci-only

What it touches

ci: 5

Modules: .github (5)

Architectural impact (arcade-agent diff_impact)

No production Java file of this PR maps into the dependency graph (tests, build, CI or docs only). Tests are excluded from the graph by design.

Build & CI relevance

• Touches CI workflows: review runner matrix, timeouts, caching.

Files