chore(ci): pin GitHub Actions to immutable commit SHAs (tag-aligned)

[Copilot]

This updates workflow action references to use immutable commit SHAs while preserving tag intent for maintainability and Dependabot-driven updates. It removes mutable refs (including a main reference) from CI/release workflows.

• Workflow action pinning

  • Updated all uses: entries in:
    • .github/workflows/python.yml
    • .github/workflows/release.yml
  • Converted tag/branch refs to full commit SHAs with inline tag annotations for scanability.

• Tag/channel preservation for Dependabot compatibility

  • Kept version/channel context in comments (e.g. # v6, # v9, # release/v1) so pinned updates remain understandable and trackable.

• Removed mutable branch ref

  • Replaced python-semantic-release/upload-to-gh-release@main with a pinned SHA mapped to a released tag line (# v9.8.9).

# before
uses: actions/checkout@v6
uses: python-semantic-release/upload-to-gh-release@main

# after
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
uses: python-semantic-release/upload-to-gh-release@0a92b5d7ebfc15a84f9801ebd1bf706343d43711 # v9.8.9