chore(security): SHA-pin actions/checkout in boj-build.yml (#61)

## Summary

- SHA-pins \`actions/checkout@v6.0.2\` →
\`actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2\`
in \`.github/workflows/boj-build.yml\`.
- Originally committed 2026-05-23 as part of a fleet-wide
workflow-hardening pass; the change had been sitting on local main,
never pushed.
- Surfaced + recovered during a 2026-05-30 closeout sweep.

## Verification

- SHA \`de0fac2e4500dabe0009e67214ff5f5447ce83dd\` confirmed real via
\`gh api
repos/actions/checkout/commits/de0fac2e4500dabe0009e67214ff5f5447ce83dd\`
→ HTTP/2 200.
- Commit \`bbdd496\` GPG-signed by ED25519 key
SHA256:kVP7Nb+Js58NvZPglm0gByBC9KeYLl/tqWpHkNN9gUA (estate canonical).
- Matches the estate-wide SHA-pinning hygiene pass (see memory:
\`feedback_verify_action_sha_pins.md\`).

## Test plan
- [x] SHA verified against actions/checkout repo (live tag, not fake)
- [x] GPG signature valid
- [ ] CI passes (running)

Author: hyperpolymath

.github/workflows/boj-build.yml

@@ -9,7 +9,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Trigger BoJ Server (Casket/ssg-mcp)
         run: |
           # Send a secure trigger to boj-server to build this repository