ci: pin the grader to a stable branch name

[lassebenni]

What I built

Repoints grade-assignment.yml from lassebenni/github-actions-fork@fix/allow-unsafe-pr-checkout-for-autograde to @stable/hyf-auto-grade, and rewrites the stale comment above it.

The old pin was labelled "Temporary pin ... Revert to HackYourFuture/github-actions@main after [PR #4]". That PR is closed without merge, so the pin is permanent. A branch named fix/... reads as disposable, and deleting or force-pushing it would silently break autograding for weeks 11, 12 and 14 at the same time.

stable/hyf-auto-grade points at the identical commit (346f1ae8). No behaviour change.

How to review

• One file changed: .github/workflows/grade-assignment.yml
• Check the uses: line now ends in @stable/hyf-auto-grade
• Check the comment block no longer claims the pin is temporary

How to run

The old branch still exists, so this is safe to merge in any order across the three repos. Open any assignment PR and confirm the Grade Assignment check still runs and produces a score.

What reviewers should see (expected results)

• uses: line: lassebenni/github-actions-fork/.github/workflows/auto-grade.yml@stable/hyf-auto-grade
• Grade Assignment check runs to completion and scores as before
• On this PR specifically the grader reports fail, because the branch carries no student work and a bare starter scores 40/100. That is the correct result, not a regression.

Self-check

• Same target commit (346f1ae8), verified before pushing
• New ref confirmed reachable via the contents API
• Grader confirmed to run to completion on the new pin
• Old branch left in place, so nothing breaks mid-migration
• Merged by a human (not me)

🤖 Generated with Claude Code

[github-actions]

📝 HackYourFuture auto grade

Assignment Score: 45 / 100 ❌

Status: ❌ Not passed
Minimum score to pass: 60
🧪 The auto grade is experimental and still being improved

Test Details

=== Week 11 Autograder ===
  ✓ PASS  found README.md
  ✓ PASS  found AI_ASSIST.md
  ✓ PASS  found week11-streamlit/app.py
  ✓ PASS  found week11-streamlit/pyproject.toml
  ✓ PASS  found week11-streamlit/uv.lock
  ✗ FAIL  missing required file: week11-streamlit/metric_definitions.md
  ✓ PASS  Level 1: required files (0/20 pts)
  ✓ PASS  root .gitignore excludes .env
  ✓ PASS  week11-streamlit/.env not committed
  ✓ PASS  app.py: no hardcoded Postgres credentials found
  ✓ PASS  Level 2: secrets hygiene (15/15 pts)
  ✓ PASS  app.py: imports a Postgres driver (sqlalchemy or psycopg2)
  ✓ PASS  app.py: reads credentials from the environment
  ✗ FAIL  app.py: raise NotImplementedError still present -- the headline KPIs panel is not implemented
  ✓ PASS  app.py: uses @st.cache_data
  ✓ PASS  Level 3: Streamlit app content (15/25 pts)
  ✗ FAIL  week11-streamlit/metric_definitions.md: empty
  ✓ PASS  Level 4: metric definitions (0/20 pts)
  ✓ PASS  README.md: dashboard link present under 'My submission'
  ✓ PASS  Level 5: Metabase dashboard documented (10/10 pts)
  ⚠ WARN  AI_ASSIST.md: present but brief or has leftover TODOs (902 chars, 4 TODO line(s))
  ✓ PASS  Level 6: AI assistance log (5/10 pts)

Score: 45 / 100  (passing: 60)  pass=false