A GitHub Actions tag is a promise, not a fact: pinning by SHA the right way

Pinning Actions to a commit SHA is a one-line change. The value is in three habits most guides skip: re-resolving the SHA yourself, keeping the Dependabot comment, and owning the moving-branch pins.