chore: pin GitHub Actions to full-length commit SHAs

[joshuarli]

Summary

• Pin all GitHub Actions references in .github/ workflow files to full-length commit SHAs

Generated by devenv pin_gha.

🤖 Generated with Claude Code

[github-actions]

Semver Impact of This PR

🟢 Patch (bug fixes)

📋 Changelog Preview

This is how your changes will appear in the changelog.
Entries from this PR are highlighted with a left border (blockquote style).

---

Internal Changes 🔧

Deps

• Bump actions/create-github-app-token from 2.0.6 to 2.1.4 by dependabot in #356
• Bump actions/upload-artifact from 4 to 5 by dependabot in #365
• Bump actions/setup-java from 4 to 5 by dependabot in #353
• Bump actions/checkout from 4 to 5 by dependabot in #350

Release

• Fix changelog-preview permissions by BYK in #373
• Switch from action-prepare-release to Craft by BYK in #371

Other

• Pin GitHub Actions to full-length commit SHAs by joshuarli in #385

• Use pull_request_target for changelog preview by BYK in #372

Other

• internal: Instrument plugin with Sentry tracing & error by buenaflor in #381

---

_{🤖 This preview updates automatically when you update the PR.}