Pin third-party GitHub Actions to SHAs and update Codecov

[kvz]

Why:

Third-party GitHub Action tags can move after review. Pinning these references to full commit SHAs makes the workflow supply-chain input immutable and prepares the repo for stricter GitHub Actions allowlist policy.

What:

• Replaced floating third-party action refs with pinned commits.
• Updated Codecov to the current v6 action before pinning it.
• Left first-party, GitHub-owned, and already SHA-pinned actions unchanged.

Changed workflows:

• .github/workflows/ci.yml

Resolved refs:

• codecov/codecov-action@v4 -> codecov/codecov-action@b9fd7d16f6d7d1b5d2bec1a2887e65ceed900238

Verification:

• git diff --check
• Ruby YAML parse for changed workflow files
• Confirmed replaced floating refs no longer appear in changed workflows

Follow-up update:

• codecov/codecov-action@v4 now resolves through the v6 commit codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 86.60%. Comparing base (5b3fb00) to head (d2bbb59).

Additional details and impacted files

@@           Coverage Diff           @@
##             main      #58   +/-   ##
=======================================
  Coverage   86.60%   86.60%           
=======================================
  Files           7        7           
  Lines         209      209           
  Branches       19       19           
=======================================
  Hits          181      181           
  Misses         28       28           

Flag	Coverage Δ
unittests	86.60% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.