fix(ci): preserve component identities and converge dependency pins

[rldyourmnd]

Summary

Converge the eight upstream action updates from #92 onto current main, including their catalog versions, pinned Checkov image, and generated Scorecard references. Fix catalog synchronization to identify independently versioned components by their catalog action prefix: a reusable workflow and tool-cache action from one repository must retain their own revisions. Previously catalog-only mode rejected this valid tree and full mode could rewrite the workflow to the action revision.

Supersedes #92. Repairs the catalog drift recorded in #94; those original failed run results remain failures.

Type of change

• Fix to an existing workflow
• Pinned tool/action version bump

Threat-model note

The dependency intent is reapplied to current main rather than copying an old workflow tree. All eight release tags were independently resolved to their exact upstream commit SHAs. The changed Checkov image was read from its pinned action definition. Synchronization updates only registered action families and component-qualified evidence references; unrelated workflow revisions and historical artifact digests are preserved. Mixed revisions within one action family are still rejected before writes.

Permissions diff

No top-level or job-level permission changes in any of the 18 affected workflows. Every workflow diff consists of full action SHA and corresponding release-comment updates. Existing token scopes, conditions, protected publication graph, timeouts, and checkout settings remain intact.

Validation

• Complete isolated validate_all.py run (core, touched, scheduled): passed against base 2f28c2ab44153c6e0c70838b442e349325406b8e.
• actionlint: passed.
• Authenticated zizmor@1.26.1 --persona pedantic --min-severity low: passed.
• Regression fixture fails with the prior synchronizer on independent components sharing one repository, and passes after this change. It checks preservation of independent workflow/action revisions and historical digests, plus idempotence; existing mixed-family rejection remains covered.
• Canonical signed commit and DCO; generated docs regenerated; changelog updated.

Checklist

• Full 40-character action pins and matching version comments.
• Least-privilege permissions; existing concurrency, timeouts, and checkout protections preserved.
• No new expression interpolation or paid feature requirement.
• Catalog and generated documentation updated.
• Local validators, actionlint, and pinned authenticated zizmor pass.
• CHANGELOG updated under Unreleased; commit signed and signed off.

Tier impact

• Public (free OSS suite)
• Private free tier (zero-cost only)
• Private paid tier (optional GHAS / harden-runner features)