[kgofron]

Summary

Harden the GitHub Actions workflow by replacing mutable action tags with immutable commit references:

• pin actions/checkout v7.0.1 to its verified commit SHA
• set persist-credentials: false after checkout
• pin both actions/upload-artifact v7.0.2 uses to its verified commit SHA

This follows the relevant supply-chain hardening from ADCore PR #602.

Scope

This is a CI-only change. It does not modify:

• the Linux build/test matrix
• the ci-scripts submodule, already at v3.4.3
• driver source or runtime behavior
• R1-8-0 or its tag
• Windows or Coveralls coverage

Validation

• official action tag references verified against their GitHub repositories
• workflow parsed successfully with Ruby and PyYAML
• no mutable action references remain in .github/workflows
• git diff --check passed