ci: SHA-pin the four unpinned actions in pages.yml

Fixing the missing SPDX header earlier in this branch advanced the Governance
workflow-security linter *past* its first gate — it `exit 1`s immediately after the
SPDX/permissions block — which uncovered a second defect in the same file that had
been masked all along:

    ERROR: Found unpinned actions:
    .github/workflows/pages.yml:25  actions/checkout@v4
    .github/workflows/pages.yml:27  actions/checkout@v4
    .github/workflows/pages.yml:44  actions/upload-pages-artifact@v3
    .github/workflows/pages.yml:57  actions/deploy-pages@v4

Same root cause as the missing header: pages.yml was dropped in by the Ddraig SSG
mass-rollout (#121) without this repo's SPDX + SHA-pinning conventions.

Pins are copied verbatim from .github/workflows/casket-pages.yml — the active,
already-compliant Pages workflow in this repo — rather than newly chosen, so the two
Pages workflows now agree. That also moves upload-pages-artifact v3 -> v5.0.0 and
deploy-pages v4 -> v5.0.0, which is what makes them consistent.

No runtime risk today: "GitHub Pages (Ddraig SSG)" is disabled_manually, so this
unblocks a linter on a workflow that does not currently run.

Verified: every action under .github/workflows/ is now SHA-pinned (no @vN/@main/@master
remains), and both modified workflows parse as valid YAML.

Note: `governance / Check Workflow Staleness` remains red and is NOT addressed here.
It was already failing on main before this branch existed (run 29688088909) — the
standards reusable pins d7c2271 are 59 commits/24d behind HEAD 8813ecf. That refresh
is shared across all callers and is being coordinated centrally, so it is deliberately
left alone.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/pages.yml

@@ -22,9 +22,9 @@ jobs:
       image: ghcr.io/stefan-hoeck/idris2-pack@sha256:f0758996a931fb35d9ecb1de273c4d59dabe2a09b433afc7e357f65a08b7e1ff
     steps:
       - name: Checkout Site
-        uses: actions/checkout@v4
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4
       - name: Checkout Ddraig SSG
-        uses: actions/checkout@v4
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4
         with:
           repository: hyperpolymath/ddraig-ssg
           path: .ddraig-ssg
@@ -41,7 +41,7 @@ jobs:
           fi
           ./.ddraig-ssg/build/exec/ddraig build src _site https://hyperpolymath.github.io/${GITHUB_REPOSITORY#*/}
       - name: Upload artifact
-        uses: actions/upload-pages-artifact@v3
+        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
         with:
           path: '_site'
   deploy:
@@ -54,4 +54,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0