Pin every action to the commit its tag points at today

A moved tag runs new code with the release signing identity, the
production Convex key and the Cloudflare token. Each uses: now names the
full commit SHA the tag resolved to (the same SHAs recent runs downloaded),
with the version in a comment.
3c67b0c589Dara Adedeji committed on 10/21/2026, 6:40:03 PMparent5eb91a3

Checks

All checks passed
6 files changedLine totals unavailable