ci: pin GitHub Actions to full commit SHAs (#207)

Pins actions/checkout and actions/setup-node to their exact commit SHAs
instead of floating v4 tags to prevent supply chain attacks via tag mutation.
Version tags are retained as inline comments for readability.

Co-authored-by: Tobias Wennergren <tobias@fal.ai>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>