[adewale]

Mutable action tags and branches can change the CI code this repository runs without a repository diff. This change pins 3 direct action references to full commits resolved from their existing upstream versions, preserving those versions in comments.

Adds an Action pinning / Check action pins workflow for pull requests, pushes, merge queues and manual runs. It installs zizmor 1.32.0 from a checksum-verified wheel and fails on unpinned-uses, including GitHub-maintained actions and remote reusable workflows. The check runs offline with config and inline exclusions disabled; unrelated security rules do not gate this change. The check's checkout action is itself SHA-pinned and does not persist credentials.

Retains the existing GitHub Actions Dependabot configuration.

Validation:

• The exact check fails on the original workflow set and passes on the proposed set.
• Negative probes reject tags, branches and shortened SHAs; positive probes accept full SHAs and local reusable workflows.
• The exact CI installer was executed successfully with the required wheel hash.
• YAML comparison confirms existing triggers, permissions, inputs and run commands are preserved.

Scope and limits: workflow/dependency-update configuration only; no application code changes. Existing full application CI has not been certified. Repository SHA-policy and required-check settings could not be configured because the connected integration lacks administration access. Those settings still need enabling after this workflow lands.