[LOW] Pin package workflows to immutable action commits

[OskarEichler]

Summary

Pin every third-party GitHub Action in the source- and binary-gem workflows to the immutable commit for its current release, while retaining readable version comments.

Urgency: LOW. The existing major-version references are movable. If an action ref or upstream repository were compromised, future CI and package-artifact builds could execute changed code without a reviewable dependency update. There is no evidence that any referenced action is currently compromised.

Pinned releases:

• actions/checkout 7.0.1
• actions/upload-artifact 7.0.1
• actions/download-artifact 8.0.1
• ruby/setup-ruby 1.321.0
• ruby/setup-ruby-pkgs 1.33.5

Verification

• Each commit was resolved directly from the corresponding upstream release tag through the GitHub API; the annotated ruby/setup-ruby-pkgs tag was dereferenced to its commit.
• Both workflow files parse successfully with Ruby/Psych.
• Every uses: entry now contains a 40-character commit.
• git diff --check

Scope and compatibility

No workflow inputs, permissions, triggers, or job behavior change.

Breaking-change note: none.