fix: repair SHA-pinned Action resolution and Code Scanning

[BLCCoreStudio]

Summary

• remove the stale hard-coded v0.1.0 fallback for non-tag Action refs
• resolve immutable SHA/branch refs to the release version declared by the pinned Action source's Cargo.toml
• dogfood the current checkout in the repository's Code Scanning workflow instead of invoking an old published Action commit
• bump the package/test expectation to 0.2.3

Why

The Code Scanning workflow was pinned to an older Action commit. Because non-tag refs fell back to v0.1.0, the workflow downloaded a binary that did not support --sarif, causing Code Scanning to fail. The same fallback also made the README's immutable-SHA pinning guidance unreliable for newer Action features.

Security

• release binary downloads remain SHA-256 verified
• the repository's Code Scanning workflow now builds and scans the exact checked-out source
• no new repository write permissions are introduced

Release

After CI is green and this merges, publish v0.2.3 through the existing Marketplace release flow.