feat(ci): verify workflow dependency lockfile

[John-David Dalton (jdalton)]

Workflow dependencies now have a generated lockfile and a CI check that verifies their commits and repository identities.

• Generate .github/workflows/actions.lock with GitHub's official gh-actions-lock v0.2.0 tool.
• Verify the pinned tool's SHA-512 before running it in CI.
• Run verification for pull requests, pushes, and the merge queue with a read-only token.
• Keep the existing checkout SHA and Dependabot schedule.

Validation: official --verify --no-interactive --json --hostname github.com returned valid: true. CI will validate the added job before merge.

---

Note

Low Risk
CI-only supply-chain hardening with read-only tokens; no application runtime or production behavior changes.

Overview
Adds GitHub Actions dependency pinning via a generated .github/workflows/actions.lock and a new actions-lock CI job in the audit workflow.

The lockfile records pinned commits and repo metadata for actions/checkout used in that workflow. On PRs, pushes to main/master, and merge queue, CI downloads gh-actions-lock v0.2.0 (with SHA-512 verification), then runs --verify against the lockfile using a read-only github.token. The existing zizmor audit job is unchanged aside from sharing the same pinned checkout SHA already reflected in the lockfile.

^{Reviewed by Cursor Bugbot for commit ac33f45. Configure here.}