ci: enforce workflow policy

[albert20260301]

Summary

• pin Linux jobs to ubuntu-24.04
• pin third-party GitHub Actions to immutable commit SHAs with reviewed version comments

Impact

This changes CI and release automation only; it does not change the SDK API, package contents, or release versions.

Validation

• bash scripts/validate-workflow-policy.sh <repository-root>
• git diff --check

The repository test suite could not run in this maintenance environment: Ruby and Python test runners are unavailable, while Go integration tests require Docker. GitHub CI will run the repository-native checks.

Cross-SDK scope

The same policy audit found equivalent drift across the SDK inventory. This PR is deliberately limited to one repository to keep review and rollback isolated.

[albert20260301]

@leo-altertable could you review this?

I picked you because the change is Python CI and your core-team stack covers Python. CI is pending. The main focus is that immutable action pins preserve the existing test and publish workflows.

[albert20260301]

@leo-altertable could you take a look at this workflow-policy PR?

All checks are green. The review focus is preserving the existing Python test and publish behavior while enforcing pinned actions and the runner policy.

[albert20260301]

@leo-altertable could you review this?

The focused workflow-policy change remains green and has been awaiting review since the prior request on August 7. The main focus is that it keeps the Python CI and release behavior intact while enforcing the shared workflow policy.

[albert20260301]

@leo-altertable: this focused workflow-policy change remains green and has had no reviewer activity since the August 10 follow-up. Could you review it when you have capacity?

[albert20260301]

@leo-altertable could you review this when you have capacity?

The focused workflow-policy change remains green after more than three days without reviewer activity. The main review focus is preserving the Python matrix and package-release behavior.

[albert20260301]

@leo-altertable could you review this when you have capacity?

This scoped change is still green and has had no reviewer activity for at least three days. The review focus is preserving the Python matrix and package-release behavior..

[albert20260301]

@leo-altertable follow-up: this is still green and unreviewed after three days. Could you review that the workflow-policy update preserves the Python matrix and package-release behavior?