ci: pin workflow actions to commits

[0thernet]

Summary:

• pin checkout, setup-node, setup-bun, and Cachix actions to reviewed full commits
• enforce read-only workflow permissions and discard checkout credentials
• add semantic YAML regression coverage and converge KB commands on v0.15.2

Validation:

• exact CI-mode Node suite: 1,149 passed, 78 skipped
• exact CI-mode Bun suite: 1,149 passed, 87 skipped
• TypeScript build typecheck
• Node and Bun workflow-action tests
• package smoke
• KB percolation, refresh, check, and agent-guide check