security(ci): SHA-pin third-party GitHub Actions (ex-ADR-0043)

[wock9000]

What

SHA-pin the floating third-party GitHub Actions in this repo to the exact commit each tag currently resolves to — behavior-identical, zero functional change. First-party actions/* keep their version tags per policy.

Why (ex-ADR-0043)

A floating tag (@v2, @stable, @main, @v1) is a mutable pointer the upstream owner — or a compromised account — can repoint at any commit, which then runs in our CI with full GITHUB_TOKEN scope and no review (the tj-actions/changed-files Mar-2025 compromise class). ex-ADR-0043 ("SHA-pin third-party GitHub Actions") requires the 40-char SHA + a trailing version/date comment. Re-seeding inheritors after the source template-rust was pinned. The advisory sha-pin-lint check (Xylem-Group/.github) flags these; this clears them for this repo.

[wock9000]

Closing: falsified premise. This repo is a MIRROR of upstream leanprover-community/physlib (7301 lemmas, only 2 first-party commits) and is being taken PRIVATE + ARCHIVED and relocated to vendored-external status (~/h/delos) per the repo-location invariant. The SHA-pin CI hardening (ex-ADR-0043) applies to first-party public repos that RUN their own CI; a frozen private mirror runs none, so this PR is moot. Any future ingest (e.g. aristarchus) pulls from the canonical upstream leanprover-community/physlib, not this mirror. Checks were green; disposition is close-superseded, not merge, to keep the mirror clean against upstream.