ci: enforce workflow policy

[albert20260301]

Summary

• pin every third-party GitHub Action in the semantic-title, release, test, and integration workflows to its reviewed commit SHA
• move Linux jobs to ubuntu-24.04
• retain the repository's .node-version and .bun-version runtime contracts

Impact

This is workflow-only hardening. It does not change the SDK packages, release contract, or runtime behavior. The existing community-file PR #180 modifies a separate legacy semantic-workflow path; it remains unsafe to merge because it would add a duplicate noncompliant check.

Verification

• bash /root/.openclaw/workspace/scripts/validate-workflow-policy.sh /root/.openclaw/workspace/code/altertable-js
• git diff --check
• YAML parse for all modified workflows
• bun run lint
• bun run test

[albert20260301]

@francoischalifour could you review this?

I picked you because recent workflow-path history points to your ownership of the release and semantic-title automation. CI is pending. The main review focus is preserving the Node/Bun trusted-publishing setup while pinning the actions and runner images.

[albert20260301]

@francoischalifour could you take a look when you have capacity?

This workflow-policy change is green and has been awaiting review since the August 10 request. The review focus is preserving the Node/Bun trusted-publishing setup while keeping the action pins and Ubuntu 24.04 runner updates correctly scoped.

[albert20260301]

@francoischalifour could you review this when you have capacity?

This scoped change is still green and has had no reviewer activity for at least three days. The review focus is preserving trusted publishing while keeping runner and immutable-action changes correctly scoped..