Fix pinned GitHub Actions across repos at once

Applies security fixes to GitHub Actions workflows across multiple repos — pins external actions to SHAs, updates internal actions to @main, and leaves a version comment for auditing.

Best for: Engineering leads securing a fleet of repos without manual yaml edits in each one.