ci: SHA-pin hyperpolymath validate-actions in dogfood-gate

a2ml-validate-action and k9-validate-action were referenced as @main,
violating the workflow-linter RSR SHA-pin requirement. Pin to current
main SHAs with # main comments so the action contents are reproducible.
  a2ml: b2f28c39491c0d1ff131b8fb9e197bfea79e411e
  k9:   f985acb62d1ed46a4b3434dc6cb148dad95cf62d

Author: hyperpolymath

.github/workflows/dogfood-gate.yml

@@ -38,7 +38,7 @@ jobs:
 
       - name: Validate A2ML manifests
         if: steps.detect.outputs.count > 0
-        uses: hyperpolymath/a2ml-validate-action@main
+        uses: hyperpolymath/a2ml-validate-action@b2f28c39491c0d1ff131b8fb9e197bfea79e411e # main
         with:
           path: '.'
           strict: 'false'
@@ -86,7 +86,7 @@ jobs:
 
       - name: Validate K9 contracts
         if: steps.detect.outputs.k9_count > 0
-        uses: hyperpolymath/k9-validate-action@main
+        uses: hyperpolymath/k9-validate-action@f985acb62d1ed46a4b3434dc6cb148dad95cf62d # main
         with:
           path: '.'
           strict: 'false'