feat: add action pin policy to scanner

[mablr]

Extends the existing scan-github-actions workflow with opt-in pinact policy checks for minimum release age and version comments.

Existing scanner callers remain unchanged because pinact defaults to disabled. Callers can enable it with pinact: true, retain repository-local .pinact.yaml exceptions, and run the policy in the scanner’s existing checkout and job.

Validation

• actionlint v1.7.12
• YAML parsing
• git diff --check

Closes OSS-542

[grandizzy]

ty! the full-SHA enforcement duplicates zizmor / scan GH action, atm only minimum-age checking (7 days old) is different which we coul fold in existing one?

[mablr]

@grandizzy good point, rescoped pr fd2f625, ptal :)

[grandizzy]

Please check the inline finding.

[tempo-voight-kampff]

Hi @grandizzy — your changes-requested review was detected by Voight-Kampff, but you rejected the approval request. Your review did not count toward this PR.

The prompt was canceled.

This request was for head fd2f625d6b83.

Re-submit the review and complete the new Voight-Kampff prompt if you want this review to count.

[grandizzy]

The Pinact integration and read-only permissions look correct, but the new regression test currently fails because it retains the deliberately broken fixture. One inline blocker; no other findings.

[tempo-voight-kampff]

Hi @grandizzy — your changes-requested review was detected by Voight-Kampff, but you rejected the approval request. Your review did not count toward this PR.

The prompt was canceled.

This request was for head fbf53726895f.

Re-submit the review and complete the new Voight-Kampff prompt if you want this review to count.

[grandizzy]

lgtm, ty!