[vmaerten]

Description

Adopt GitHub Actions dependency lockfiles in public preview across all seven workflows. Replace inline SHA references with version tags while preserving the existing commits in actions.lock, including transitive action dependencies.

Add a CI job to verify the lockfile, Renovate tracking for the pinned gh-actions-lock extension, and contributor instructions for regenerating the lockfile.

Validated with gh actions-lock --verify and gh actions-lock --verify-local. Confirmed that all 39 existing action references retain their original commits. The lockfile verification job also passed on this PR.

AI disclosure: Codex assisted with the implementation and this PR description at the maintainer's request.

Checklist

• I have read and followed the Contribution Guide.
• I have disclosed the use of any AI-generated content in this pull request per the AI Usage Policy.
• I fully understand the changes and, as a maintainer, have requested an AI-assisted description as an exception to the handwritten-description requirement.