fix(ci): SHA-pin the last unpinned action, in pages-deploy.yml

`Deploy to Cloudflare Workers` fails on main with:

  The action actions/checkout@v4 is not allowed in hyperpolymath/boj-server
  because all actions must be pinned to a full-length commit SHA.

This is GitHub's own `sha_pinning_required: true` repo policy, which was
deliberately preserved when allowed_actions moved selected -> all. Unlike
BROKEN-M1 it is a *correct* refusal: the action really was unpinned.

Worth recording how it was found, because two linters missed it. Both the
`Workflow security linter` and my local replication of it match `uses:`
only at the start of a line (after indentation), so both see

    - name: Checkout
      uses: actions/checkout@v4          # caught

but not the inline list-item form actually used here:

    - uses: actions/checkout@v4          # MISSED

That single blind spot is why governance reported exactly 4 unpinned
actions (all in pages.yml) while the repo in fact had 5, and why the
scan undercounted `uses:` lines 66 vs the true 94. GitHub's policy engine
caught what the linter could not. The upstream pattern in
hyperpolymath/standards has the same gap and should be widened
separately; this commit fixes the instance.

Pinned to de0fac2e (v6.0.2), the same checkout every other workflow in
this repo now uses.

Verified with a corrected pattern matching BOTH forms: 0 of 94 `uses:`
lines are unpinned.

Not addressed here (no CI impact, flagged for follow-up): the deploy step
runs `npx wrangler@latest`, which is an unpinned floating dependency in a
job that holds CLOUDFLARE_API_TOKEN.

Author: hyperpolymath

.github/workflows/pages-deploy.yml

@@ -18,7 +18,7 @@ jobs:
   deploy:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Deploy site/ to Cloudflare Workers (static assets)
         run: npx wrangler@latest deploy
         env: