ci(security): pin GitHub Actions to immutable commits

[GSTJ]

Summary

The release and pull-request checks now execute the same reviewed code on every run.

Details

• Keeps actions/checkout on v7.0.1 while preventing tag retargeting from changing the release job.
• Keeps the shared GSTJ/magic CI, setup, and release behavior on v1 at commit aa331e83282c2794edd474646c671f036dfabee0.
• Fixes the CodeQL actions/unpinned-tag alert raised by extended scanning.

Testing steps

1. Run:

actionlint
pnpm run format
pnpm run lint
pnpm run typecheck
pnpm test --runInBand
pnpm run build
pnpm run changelog:check

2. Confirm every command exits successfully and the test run reports six passing tests.
3. Open the PR checks and confirm the branch checkup and CodeQL jobs pass with the pinned workflows.

[GSTJ]

Recorded from agent/pin-github-actions at 9196d12. The local run shows actionlint checking both workflows with zero errors, followed by both Jest suites passing.