ci: pin document deploy workflow actions to immutable SHAs

[grtninja]

Summary

• pin the two floating actions in .github/workflows/document_deploy.yml to immutable SHAs
• preserve the existing MkDocs deploy behavior and workflow scope
• keep the change one-file and targeted to pre-release per the contributor guide

Validation

• git diff --check
• python -c "import pathlib, yaml; p=pathlib.Path(r'.github/workflows/document_deploy.yml'); yaml.safe_load(p.read_text(encoding='utf-8')); print('yaml_ok', p)"
• final exact-file overlap recheck on open pre-release PRs found no other open PR touching .github/workflows/document_deploy.yml

Notes

• contributor guidance says PRs should target pre-release, and this PR follows that
• this is a one-file workflow hardening pass only; no runtime or docs changes
• prepared with AI assistance and manually validated before submission