Summary by cubic

Pinned all GitHub Actions in CI workflows to specific commit SHAs to harden supply chain and make runs reproducible. No behavior changes expected.

Description

• Summary of changes
  • Replaced floating tags with commit SHAs for actions/checkout, actions/setup-node, actions/upload-artifact, actions/download-artifact, actions/dependency-review-action, peter-evans/create-pull-request, and github/ai-moderator across moderator.yml, publish.yml, release-branch.yml, run-ci.yml, and update-sponsor-block.yml.
• Reasoning
  • Prevents unexpected updates and reduces supply‑chain risk.
• Additional context
  • Kept inline version comments for clarity. No workflow logic changes.

Docs

• No docs updates needed. Maintain pinned SHAs when upgrading Actions.

Testing

• No tests added or changed. CI-only change; existing workflows should continue to pass. No additional tests needed.

^{Written for commit f52e6ad. Summary will update on new commits.}