chore: pin GitHub Actions (#90)

Pins GitHub Actions references to commit SHAs across workflow, reusable
workflow, and composite action definitions.

Co-authored-by: OpenAI Codex <codex@openai.com>

Author: jbeckwith-oai

.github/workflows/test.yml

@@ -54,7 +54,7 @@ jobs:
 
     steps:
       - name: Wait for all PR checks to succeed
-        uses: promptfoo/.github/.github/actions/ci-success@main
+        uses: promptfoo/.github/.github/actions/ci-success@06453faf6e513174f5ee0b340bac7cdfa41bf437 # main
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           timeout-seconds: 300