Gate releases and documentation publication and pin Actions

[hideouts-io]

Changes

Pins all external Actions to upstream-verified full commit SHAs. Release publication waits for human approval in github-release; documentation builds on pushes and PRs, while Pages publication requires a manual dispatch from main and protected approval. Preserves the existing Python test, Python CodeQL, dependency review, strict documentation, and both packaging architecture gates.

Verification

Candidate: e292fa6c08886ef7d37cb13a72e494b9fdbc7d02.

• Python analysis passed at test-merge bfdd9fcef055d7eda58d1df7bb45cf63694939cf: 62 of 62 tracked Python files were analyzed and upload processing completed. This does not claim separate Actions-language query coverage.
• Dependency review and the strict documentation build passed.
• Both arm64 and x86_64 frozen application builds and existing packaged smoke checks passed.
• The required Tests job passed on attempt 2 at this exact candidate: 133 tests ran successfully, followed by successful module compilation, command entry-point checks, command-catalog verification, and the offscreen GUI smoke test. The retry changed no code, deadline, assertion, or gate.
• Documentation publication was deliberately skipped on this PR. Product releases and production deployments were not authorized or performed.

Existing checks and protections remain intact. Skipped or neutral checks are not counted as executed tests or analysis.

Scope

Focused GitHub infrastructure and repository instructions. Existing canonical checkout work is preserved in place; implementation uses an isolated worktree. Authorization applies only to this task and does not grant future Git or publication permission.