chore: pin GitHub Actions to full-length commit SHAs

[joshuarli]

Summary

• Pin all GitHub Actions references in .github/ workflow files to full-length commit SHAs

Generated by devenv pin_gha.

🤖 Generated with Claude Code

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

[cursor]

Empty permissions may break reusable updater workflow

Medium Severity

The permissions: {} addition is unrelated to SHA pinning and restricts the GITHUB_TOKEN to have zero permissions. Since this workflow calls the getsentry/github-workflows/.github/workflows/updater.yml reusable workflow, the called workflow inherits this empty permission set and cannot escalate beyond it. If the reusable updater workflow relies on GITHUB_TOKEN for any operations (e.g., checking out code, creating PRs), those operations will fail silently. This change only triggers on schedule or push to main, so it won't be caught by PR-level testing.