chore(ci): Bump pnpm/action-setup to v5 and pin to commit SHA

Bump from v4 to v5.0.0 which uses Node.js 24 (resolves the GHA
deprecation warning for Node.js 20 actions). Pin to the exact commit
SHA for supply chain security.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: mydea

.github/workflows/build.yml

@@ -922,7 +922,7 @@ jobs:
         uses: actions/checkout@v6
         with:
           ref: ${{ env.HEAD_COMMIT }}
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
         with:
           version: 9.15.9
       - name: Set up Node
@@ -1054,7 +1054,7 @@ jobs:
         uses: actions/checkout@v6
         with:
           ref: ${{ env.HEAD_COMMIT }}
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
         with:
           version: 9.15.9
       - name: Set up Node

.github/workflows/canary.yml

@@ -126,7 +126,7 @@ jobs:
         uses: actions/checkout@v6
         with:
           ref: ${{ env.HEAD_COMMIT }}
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
         with:
           version: 9.15.9
       - name: Set up Node