[rgarcia]

Follow-up to #26. That PR rewrote the SHA-pinned uses: lines in the generator-owned workflows to release tags, so they no longer match what the SDK generator emits. A later generation would revert them and could conflict with them as custom code.

• Every uses: line goes back to exactly what the generator emitted (<sha> # <version>), with one exception: release-please.yml pinned pnpm/action-setup@f40ffcd… (# v4). That is the SHA of the annotated v4 tag object, not a commit, so it can't be locked. It now pins b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0, the commit that tag points to, so what runs doesn't change.
• .github/workflows/actions.lock was regenerated with gh actions-lock --no-narrow, so it records each action by SHA along with its release tag. All workflows are onboarded, including release-please.yml. gh actions-lock --verify passes.
• Once the generator template emits b906aff for pnpm/action-setup, the next promotion will match this line.
• Not covered (unchanged): the job-level reusable workflow calls to kernel/security-workflows/...@main.