ci: pin actions to full commit SHAs in claude.yml

[XananasX7]

Summary

Pins actions/checkout and anthropics/claude-code-action in the Claude workflow to immutable full commit SHAs.

Vulnerability

Using mutable version tags (@v4, @v1) creates a supply-chain risk — if either action repository is compromised, an attacker could push malicious code under the same tag that would silently run in CI with access to secrets.ANTHROPIC_API_KEY and write permissions on contents, pull-requests, and issues.

The Claude workflow is particularly sensitive because it has broad permissions:

permissions:
  contents: write
  pull-requests: write
  issues: write
  id-token: write

Fix

Action	Before	After
actions/checkout	@v4	@34e1148 (v4)
anthropics/claude-code-action	@v1	@a92e7c7 (v1)

Both pins point to the exact same code as the current tags. Behaviour is unchanged.

References

• https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-third-party-actions
• tj-actions supply chain incident (2025)