Reject mutable GitHub Action references

[biru-codeastromer]

Summary

• scan GitHub workflows and composite action definitions during the repository audit
• accept local actions and external actions pinned to a full lowercase 40-character commit SHA
• reject mutable tags, branches, short SHAs, dynamic expressions, and container tags with file-and-line diagnostics
• document the enforcement in contribution and security policy

Evidence

• make release-gate: 102 passed, 1 optional skip, 91.83% coverage
• eight focused valid/adversarial action-reference cases pass
• the current workflow set passes the new scanner
• repository audit, text policy, clean wheel install, dependency audit, example workflow, and Gitleaks passed

This PR is independent of #22-#25 and is ready for maintainer review.

[biru-codeastromer]

The YAML-format and nested-action blockers are fixed at the new head. The audit now uses a safe YAML syntax tree, recognizes spaced and quoted uses keys plus flow mappings, rejects malformed and non-scalar references, and discovers action.yml or action.yaml in any tracked directory. Exact local gate: 112 passed, 1 optional skip, 91.83% coverage, repository/dependency/text audits, clean installs, example, and full-history Gitleaks all green.

[biru-codeastromer]

Superseded by merged #41, which preserves this change in the protected v0.4.0 release stack.