chore: SHA-pin GitHub Actions

[skonefal]

SHA-pin GitHub Actions to commit hashes.

[cursor]

PR Summary

Low Risk
Workflow-only pinning with no application logic changes; behavior should match the same tagged versions already in use.

Overview
Pins third-party GitHub Actions to immutable commit SHAs in pull-request.yaml and py-publish.yaml, replacing floating tags like @v6 and @v7.

Affected steps: actions/checkout, astral-sh/setup-uv (both jobs in the PR workflow), and pypa/gh-action-pypi-publish in the release workflow. Each pin keeps a comment with the original tag for readability.

This aligns those workflows with supply-chain hardening so CI and PyPI publish run fixed action revisions instead of whatever a moving tag might resolve to.

^{Reviewed by Cursor Bugbot for commit 14cb498. Configure here.}

[bh2smith]

Seems legit.