Fix the compiler and workflow sources #60226

github/gh-aw-actions PR #238 (chore: sync actions from gh-aw@v0.89.4) regenerated workflows that triggered zizmor findings. Do not add broad or permanent zizmor suppressions. Fix the compiler and workflow source so regenerated artifacts are secure by construction.

Historical precedent in github/gh-aw-actions:

• Pin mutable uses: references to immutable commit SHAs (unpinned-uses).
• Ensure SHA comments match the actual action version (ref-version-mismatch).
• Use persist-credentials: false for read-only checkouts (artipacked).
• Bind dynamic GitHub expressions through env: before using them in shell commands (template-injection).

Required changes

1. Emit immutable action references in action mode

Investigate and update:

• pkg/workflow/action_reference.go

When compiling in action mode, require resolution of action references to full immutable commit SHAs. Do not emit a mutable fallback such as:

uses: github/gh-aw-actions/setup@vX.Y.Z