Pin GitHub Actions to commit SHA instead of mutable tags

[Jaro-c]

Same thing I flagged in opencore — publish.yml references actions by mutable tag (actions/checkout@v4, actions/setup-go@v5, softprops/action-gh-release@v2, etc.), and this workflow holds contents: write and id-token: write, so a compromised tag would run with publish/release permissions.

I'd pin every uses: to a full commit SHA — same fix as newcore-network/opencore#68, worth doing consistently across both repos.

Split out from #19.