Pin actions to commit SHAs and fix stale version comments

[ChrisJBurns]

Summary

• arduino/setup-task@v2 is a branch, not a tag. Eleven references across six workflows point at it, so whatever that branch happens to be at run time is what executes in CI. It currently resolves to b91d5d2c96a56797b48ac1e0e89220bf64044611 — which is already the pin used in e2e-tests.yml — so pinning the rest to that SHA changes nothing today while removing the mutable-ref exposure and making the repo internally consistent.
• Four pins had a version comment that named a different version than the commit. The pin is what actually executes, so this is an audit and review problem rather than a functional one — but a wrong comment is worse than no comment, because reviewers trust it when deciding whether a bump is safe. Every corrected value is copied from an existing pin of the identical SHA elsewhere in this repo, so nothing here is a guess.

File	Was	Now	Taken from
claude.yml	# v1	# v1.0.183	issue-triage.yml
release-notes.yml	# v1	# v1.0.183	issue-triage.yml
operator-ci.yml	# pin@v1.12.0	# v1.14.0	helm-charts-test.yml
test-e2e-lifecycle.yml	# pin@v1.12.0	# v1.14.0	helm-charts-test.yml

No action is upgraded or downgraded by this PR — every SHA that was already pinned stays exactly as it was.

Part of #6253

Type of change

• Bug fix
• New feature
• Refactoring (no behavior change)
• Dependency update
• Documentation
• Other (describe): CI configuration

Test plan

• Unit tests (task test)

• E2E tests (task test-e2e)

• Linting (task lint-fix)

• Manual testing (describe below)

• Confirmed via the GitHub API that arduino/setup-task has no v2 tag — refs/heads/v2 is a branch, currently at b91d5d2c, matching the pin already in e2e-tests.yml.

• Confirmed each corrected comment against an existing unflagged pin of the same SHA in this repo.

• actionlint reports nothing new; all workflows still parse as YAML.

• zizmor unpinned-uses goes 11 → 0 and ref-version-mismatch 5 → 1, the remainder being the upload-sarif pin fixed separately in Add zizmor to CI and stop double-running the security scan #6251.

• Every touched workflow runs on pull requests, so this PR exercises all of them directly.

Does this introduce a user-facing change?

No.

Special notes for reviewers

The six operator-ci.yml changes are the same one-line edit repeated per job.

Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 72.71%. Comparing base (e7dd5fa) to head (960d1c6).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #6254   +/-   ##
=======================================
  Coverage   72.70%   72.71%           
=======================================
  Files         742      742           
  Lines       77299    77299           
=======================================
+ Hits        56199    56205    +6     
+ Misses      17137    17128    -9     
- Partials     3963     3966    +3     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.