fix(ci): replace fake action SHA pins (estate-wide niche sweep) (#30)

Comprehensive sweep across all niche fake SHAs found in the 2026-05-30
estate audit. Substitutions are version-faithful where the intended
version exists; bumped to nearest in-major where the version comment
was also hallucinated (e.g. v3.18.3 of action-slack didn't exist).

All real SHAs verified via gh api repos/<org>/<action>/commits/<sha>.

Provenance: project_estate_fake_action_sha_punch_list_2026_05_30.

Author: hyperpolymath

.github/workflows/hpc-ci.yml

@@ -47,7 +47,7 @@ jobs:
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Install Zig
-        uses: mlugg/setup-zig@a84e3471d7b1bba559a4b37a498c9ceee22f36c8 # v2
+        uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29 # v2
         with:
           version: ${{ env.ZIG_VERSION }}