ci: pin release workflow actions

[FanouZeng-TT]

Description

.github/workflows/release.yml publishes to PyPI with trusted publishing, so
the job holds id-token: write, but its three actions use floating refs:

uses: actions/checkout@v5
uses: astral-sh/setup-uv@v8.2.0
uses: pypa/gh-action-pypi-publish@release/v1

A moved tag or branch would change what code runs in the publishing job
without any review in this repository. tests.yml and linter.yml already
pin their actions to full commit SHAs and run checkout with
persist-credentials: false; the release job is the only one that departs
from that pattern, and it is the one with publish permissions.

Fix: pin all three actions to the commits the floating refs resolve to
today, keep the version in a trailing comment, add
persist-credentials: false to checkout, and fix the inz 'dist/' comment
typo. Trigger, permissions, environment, build and publish behavior are
unchanged.

Category (Required)

• Core Protocol: Changes to the base communication layer, global context, or breaking refactors. (Requires Technical Council approval)
• Governance/Contributing: Updates to GOVERNANCE.md, CONTRIBUTING.md, or CODEOWNERS. (Requires Governance Council approval)
• Capability: New schemas (Discovery, Cart, etc.) or extensions. (Requires Maintainer approval)
• Documentation: Updates to README, or documentations regarding schema or capabilities. (Requires Maintainer approval)
• Infrastructure: CI/CD, Linters, or build scripts. (Requires DevOps Maintainer approval)
• Maintenance: Version bumps, lockfile updates, or minor bug fixes. (Requires DevOps Maintainer approval)
• SDK: Language-specific SDK updates and releases. (Requires DevOps Maintainer approval)
• Samples / Conformance: Maintaining samples and the conformance suite. (Requires Maintainer approval)
• UCP Schema: Changes to the ucp-schema tool (resolver, linter, validator). (Requires Maintainer approval)
• Community Health (.github): Updates to templates, workflows, or org-level configs. (Requires DevOps Maintainer approval)

Related Issues

N/A

Checklist

• I have followed the Contributing Guide (including Conventional Commits title requirements and ! for breaking changes).
• I have updated the documentation (if applicable).
• My changes pass all local linting and formatting checks.
• I have added tests that prove my fix is effective or that my feature works.
• New and existing unit tests pass locally with my changes.
• (For Core/Capability) I have included/updated the relevant JSON schemas.
• I have regenerated Python Pydantic models by running generate_models.sh under python_sdk.

Screenshots / Logs (if applicable)

• Resolved refs (2026-09-11): actions/checkout@v5 → fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09, astral-sh/setup-uv@v8.2.0 → fac544c07dec837d0ccb6301d7b5580bf5edae39, pypa/gh-action-pypi-publish@release/v1 → dc37677b2e1c63e2034f94d8a5b11f265b73ba33
• uvx pre-commit run --all-files — all hooks passed, including ShellCheck v0.10.0
• python -m unittest discover -s tests -p 'test_*.py' — 148 tests OK (4 skipped)
• git diff --check — passed

🤖 Generated with Claude Code