fix(ci): hypatia self-clean — replace 3 fake action SHA pins (#401)

## Summary

Hypatia carried 3 fake SHA pins in its own workflows. Self-clean so
hypatia passes its own `:known_fake_action_sha` rule (#397) when
scanning itself.

## Substitutions (version-faithful where possible)

| Action | Sites | Fake SHA | Real replacement | Version |
|---|---|---|---|---|
| `Swatinem/rust-cache` | 7 (ci.yml ×4, tests.yml ×3, release.yml ×1) |
`ad397744...b8db` | `9d47c6ad4b02e050fd481d890b2ea34778fd09d6` | v2.7.8
(intent preserved) |
| `haskell-actions/hlint-run` | 1 (ci.yml) | `75c62c3b...6ce2` |
`0b0024319753ba0c8b2fa21b7018ed252aed8181` | v2.4.9 (intent preserved) |
| `haskell-actions/hlint-setup` | 1 (ci.yml) | `17f0f409...ddfa` |
`fe9cd1cd1af94a23900c06738e73f6ddb092966a` | **v2.4.10 (bumped —
original `# v2.7.0` was doubly fictional)** |

### Note on hlint-setup

The original
`haskell-actions/hlint-setup@17f0f4093d35cfdbf02aab186d51d0bb8b92ddfa #
v2.7.0` was fake at TWO levels: the SHA doesn't exist, AND the version
`v2.7.0` was never released. `hlint-setup`'s tag history only goes up to
v2.4.10. Bumped to v2.4.10 (current latest) rather than try to preserve
a version that never existed.

## Verification

All three real SHAs return 200 from `gh api
repos/<org>/<action>/commits/<sha>`. Verified pre-commit.

## Why one PR for both action families

The round-2 estate sweep in flight (~46 repos, version-faithful
substitution map) handles `rust-cache@ad397744...` but NOT
`hlint-run`/`hlint-setup` — those aren't in the substitution map. Filing
both fixes in one PR for hypatia means:

1. Hypatia is fully self-clean immediately (passes its own rule)
2. When the in-flight sweep reaches hypatia, it'll see
`corrected_not_emitted` (no-op) — clean handoff
3. No leftover hlint fixes deferred to a separate PR

## Provenance

Estate audit 2026-05-30 found 67 fake action SHA pairs; the in-flight
round-2 sweep handles 26 substitutions across 46 repos; ~25 niche
single-repo fakes including hlint were documented as deferred. This PR
moves the 2 hlint fakes from "deferred" to "done" since they're in
hypatia's own repo and there's symbolic value to hypatia being
self-clean.

See `project_estate_fake_action_sha_punch_list_2026_05_30.md` for the
full substitution map context.

## Test plan

- [ ] `gh api` returns 200 for all 3 new SHAs (verified)
- [ ] No remaining fake-SHA occurrences in hypatia's workflows (verified
via grep)
- [ ] CI passes (rust-cache + hlint behaviour is identical, just real
SHAs)

Author: hyperpolymath

.github/workflows/ci.yml

@@ -40,7 +40,7 @@ jobs:
           components: clippy, rustfmt
 
       - name: Setup Rust cache
-        uses: Swatinem/rust-cache@ad397744b0d591a723ab90405b7247fac0e6b8db # v2.7.8
+        uses: Swatinem/rust-cache@9d47c6ad4b02e050fd481d890b2ea34778fd09d6 # v2.7.8
         with:
           workspaces: ". -> target"
           cache-on-failure: true
@@ -81,7 +81,7 @@ jobs:
           toolchain: stable
 
       - name: Setup Rust cache
-        uses: Swatinem/rust-cache@ad397744b0d591a723ab90405b7247fac0e6b8db # v2.7.8
+        uses: Swatinem/rust-cache@9d47c6ad4b02e050fd481d890b2ea34778fd09d6 # v2.7.8
         with:
           workspaces: ". -> target"
           cache-on-failure: true
@@ -112,7 +112,7 @@ jobs:
           tool: cargo-llvm-cov
 
       - name: Setup Rust cache
-        uses: Swatinem/rust-cache@ad397744b0d591a723ab90405b7247fac0e6b8db # v2.7.8
+        uses: Swatinem/rust-cache@9d47c6ad4b02e050fd481d890b2ea34778fd09d6 # v2.7.8
         with:
           workspaces: ". -> target"
           cache-on-failure: true
@@ -196,12 +196,12 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Setup HLint
-        uses: haskell-actions/hlint-setup@17f0f4093d35cfdbf02aab186d51d0bb8b92ddfa # v2.7.0
+        uses: haskell-actions/hlint-setup@fe9cd1cd1af94a23900c06738e73f6ddb092966a # v2.4.10
         with:
           version: '3.8'
 
       - name: Run HLint
-        uses: haskell-actions/hlint-run@75c62c3bed4ab3e4c85c64ed8f287478c5f86ce2 # v2.4.9
+        uses: haskell-actions/hlint-run@0b0024319753ba0c8b2fa21b7018ed252aed8181 # v2.4.9
         with:
           path: registry/
           fail-on: warning

.github/workflows/release.yml

@@ -93,7 +93,7 @@ jobs:
           targets: ${{ matrix.target }}
 
       - name: Setup Rust cache
-        uses: Swatinem/rust-cache@ad397744b0d591a723ab90405b7247fac0e6b8db # v2.7.8
+        uses: Swatinem/rust-cache@9d47c6ad4b02e050fd481d890b2ea34778fd09d6 # v2.7.8
         with:
           workspaces: ". -> target"
           key: ${{ matrix.target }}

.github/workflows/tests.yml

@@ -224,7 +224,7 @@ jobs:
           toolchain: stable
 
       - name: Setup Rust cache
-        uses: Swatinem/rust-cache@ad397744b0d591a723ab90405b7247fac0e6b8db # v2.7.8
+        uses: Swatinem/rust-cache@9d47c6ad4b02e050fd481d890b2ea34778fd09d6 # v2.7.8
         with:
           workspaces: ". -> target"
           cache-on-failure: true
@@ -485,7 +485,7 @@ jobs:
           tool: cargo-llvm-cov
 
       - name: Setup Rust cache
-        uses: Swatinem/rust-cache@ad397744b0d591a723ab90405b7247fac0e6b8db # v2.7.8
+        uses: Swatinem/rust-cache@9d47c6ad4b02e050fd481d890b2ea34778fd09d6 # v2.7.8
         with:
           workspaces: ". -> target"
 
@@ -636,7 +636,7 @@ jobs:
           toolchain: stable
 
       - name: Rust cache
-        uses: Swatinem/rust-cache@ad397744b0d591a723ab90405b7247fac0e6b8db # v2.7.8
+        uses: Swatinem/rust-cache@9d47c6ad4b02e050fd481d890b2ea34778fd09d6 # v2.7.8
         with:
           workspaces: ". -> target"
           cache-on-failure: true