chore: Pin third-party GitHub Actions to full commit SHAs

[devin-ai-integration]

file:///home/ubuntu/pin-actions/edge-agent_pr_body.md

Link to Devin session: https://app.devin.ai/sessions/add87be2227046f198fbac38a32e5358

[devin-ai-integration]

Original prompt from will.porter

'Pin all third-party Github Actions for Public SDKs' (SECENG-294)

User instruction: @devin can you look at the workos organization in github, and report back all of the public repositories that are not archived, and whether or not if they use any github workflows?

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring

[devin-ai-integration]

Third-Party Action SHA Age Report

Action	Pinned Version	Full SHA	Commit Date	Age (days)	Status
actions/checkout	v4	34e114876b0b11c390a56381ad16ebd13914f8d5	2025-11-13	166	✅ OK
actions/setup-go	v5	40f1582b2485089dde7abd97c1529aa768e1baff	2025-12-15	134	✅ OK
docker/login-action	v3	c94ce9fb468520275223c153574b00df6fe4bcc9	2026-01-27	91	✅ OK
docker/setup-qemu-action	v3	c7c53464625b32c7a7e944ae62b3e17d2b600130	2025-11-05	175	✅ OK