GitHub recently added support for requiring actions to be pinned to a
full-length commit SHA[^1].
Their changelog doesn't mention that composite actions also fail if
their own actions are not pinned, which is the case for this project.
Hope this makes sense. I didn't bump the versions, just added the commit
SHAs, using `pinact run`.
[^1]: https://github.blog/changelog/2025-08-15-github-actions-policy-now-supports-blocking-and-sha-pinning-actions/