[codex] Pin GitHub Actions workflows

[KickNext]

Summary

• Pin external GitHub Actions and the pub.dev reusable publish workflow to immutable full commit SHAs.
• Narrow the Pages workflow permissions so only the deploy job receives pages: write and id-token: write.
• Keep tag comments beside each pin to make future dependency updates easier to review.

Why

The security scan found two supply-chain hardening issues: privileged workflows used mutable @vN refs, and the Pages workflow granted deploy/OIDC authority at workflow scope. Pinning refs and narrowing permissions reduces the blast radius of upstream tag movement or action compromise.

Validation

• Parsed .github/workflows/*.yml successfully.
• flutter analyze
• flutter test
• flutter analyze from example/
• flutter test from example/
• dart pub publish --dry-run (reel_text 0.4.0, 0 warnings)
• rg "uses: .*@(v[0-9]+|main|master|stable)" .github/workflows found no mutable workflow refs.

Notes

The previous security report mentioned 0.1.6 because the local checkout used for the scan was stale. This branch is based on the current origin/main at v0.4.0.