Pin GitHub Actions to commit hashes with version tags

[Copilot]

All GitHub Actions in workflow files are now pinned to commit hashes instead of mutable version tags, improving supply chain security by preventing unexpected changes from upstream action updates.

Changes:

• Pinned 8 distinct actions across 22 uses to their commit SHA-256 hashes
• Added version tag comments for human readability: action@<commit-hash> # <version>
• Updated to specific patch versions (v6.0.1, v3.7.0, v3.3.0, v5.0.0, v6.1.0, v6.0.0)

Format:

- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8  # v6.0.1
- uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130  # v3.7.0
- uses: pypa/cibuildwheel@63fd63b352a9a8bdcc24791c9dbee952ee9a8abc  # v3.3.0

Actions Updated:

• actions/checkout, actions/setup-python, actions/upload-artifact, actions/download-artifact
• docker/setup-qemu-action, pypa/cibuildwheel
• ilammy/msvc-dev-cmd, softprops/action-gh-release

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[Copilot]

Pull request overview

This PR enhances supply chain security by pinning all GitHub Actions to immutable commit SHA-256 hashes instead of mutable version tags. Each pinned action includes a human-readable version comment for maintainability.

Key Changes:

• Pinned 8 distinct GitHub Actions to their commit hashes across 22 uses in the release workflow
• Added inline version tag comments in the format action@<commit-hash> # <version> for readability
• Updated actions to specific versions for checkout, upload/download artifacts, Python setup, QEMU setup, cibuildwheel, MSVC setup, and GitHub release creation

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The version comment uses "v2" without a specific patch version, which is inconsistent with other actions in this PR that use specific patch versions (e.g., v6.0.1, v3.7.0). Consider using a more specific version tag like "v2.x.x" for consistency and clarity, or verify that v2 is indeed the most specific tag available for this action.