SEC: pin changesets/action to full commit SHA

changesets/action@v1 is a mutable tag; pin to the v1.9.0 commit SHA
to prevent supply-chain attacks via tag movement.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: sschupbach-salesforce

.github/workflows/release.yml

@@ -46,7 +46,7 @@ jobs:
 
       - name: Create Version PR or publish
         id: changesets
-        uses: changesets/action@v1
+        uses: changesets/action@a45c4d594aa4e2c509dc14a9f2b3b67ba3780d0d # v1.9.0
         with:
           publish: npx changeset publish
           title: 'chore: version packages'