fix(ci): SHA-pin actions/checkout in cowork-auto-pr workflow

The cowork-auto-pr.yml workflow used unpinned actions/checkout@v4 while
all other workflows (ci.yml, publish.yml, release-audit.yml) use SHA-pinned
versions. This creates supply-chain risk and inconsistency.

Pinned to d23441a48e516b6c34aea4fa41551a30e30af803 (v6) to match the
fleet standard.

Author: Coding-Dev-Tools

.github/workflows/cowork-auto-pr.yml

@@ -16,7 +16,7 @@ jobs:
       # without this step every run failed with "not a git repository" and no
       # PR was ever opened (fleet-wide defect: 11/11 seeded copies lacked it).
       - name: Check out the pushed branch
-        uses: actions/checkout@v4
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
           ref: ${{ github.ref_name }}
           fetch-depth: 0