chore: Pin release workflow actions to commit SHAs

[Pringled]

Pins every action in release.yaml to a commit SHA (with the version in a comment) instead of mutable tags like @v4 and @release/v1, so a moved tag cannot change what runs with the PyPI publish token. Same versions as before (latest within each major).

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[greptile-apps]

Confidence Score: 5/5

[High risk] Release workflow now pins GitHub Actions to specific commits.

The PR appears safe to merge; no actionable regression was established.

_{Reviews (1) · Last reviewed commit: "Pin release workflow actions to commit S..."}