fix(ci): correct publish workflow SHA pins (unblocks npm + JSR) (#88)

## Summary

Both action SHA pins in \`.github/workflows/publish.yml\` resolved to
nonexistent refs, causing every publish since v0.4.1 to fail at the
*action download* stage (before any of our code ran):

| Action | Before | After | Cause |
|---|---|---|---|
| \`actions/setup-node\` v4.4.0 |
\`49933ea5288caeca8642**195f882660b323136e2a**\` |
\`49933ea5288caeca8642**d1e84afbd3f7d6820020**\` | SHA suffix typo'd —
first 19 chars match the real SHA, last 21 chars diverged |
| \`denoland/setup-deno\` v2.1.1 |
\`909cc5acb0fdd60627fb858598190e9d10232b3a\` |
\`667a34cdef165d8d2b2e98dde39547c9daac7282\` (v2.0.4) | Tag v2.1.1
**does not exist**; highest available is v2.0.4 |

Re-verified both SHAs via \`gh api
repos/<owner>/<action>/git/refs/tags/...\`.

## Evidence

Failed runs since the bad pins landed: [25013192716
(v0.4.6)](https://github.com/hyperpolymath/boj-server/actions/runs/25013192716),
[24738743650 (v0.4.1
retry)](https://github.com/hyperpolymath/boj-server/actions/runs/24738743650),
and earlier. Each errors with:

\`\`\`
##[error]Unable to resolve action \`actions/setup-node@49933ea...\`,
unable to find version
##[error]Unable to resolve action \`denoland/setup-deno@909cc5ac...\`,
unable to find version
\`\`\`

## Why this matters

This is the actual gate on the Glama Quality C → A fix. npm has been
stuck at v0.4.1 (with the v0.3.1-era stub tool descriptions) since the
publish workflow broke. Tagging v0.4.7 with this fix in place will run
the v0.4.7 publish to completion, which surfaces the AAA-tier tool
descriptions to npm, which Glama then re-scans.

## Test plan

- [ ] CI green on this PR
- [ ] Merge → tag \`v0.4.7\` → workflow runs to completion
- [ ] \`npm view @hyperpolymath/boj-server@latest version\` returns
\`0.4.7\`
- [ ] JSR package updates to 0.4.7

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/publish.yml

@@ -24,7 +24,7 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Setup Node.js
-        uses: actions/setup-node@49933ea5288caeca8642195f882660b323136e2a # v4.4.0
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: '22'
           registry-url: 'https://registry.npmjs.org'
@@ -51,7 +51,7 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Setup Deno
-        uses: denoland/setup-deno@909cc5acb0fdd60627fb858598190e9d10232b3a # v2.1.1
+        uses: denoland/setup-deno@667a34cdef165d8d2b2e98dde39547c9daac7282 # v2.0.4
         with:
           deno-version: v2.x