Pin octocov workflow actions

[kitsuyui]

Summary

• Pin the octocov workflow's third-party actions to full commit SHAs.
• Keep the original tag names as inline comments for review and future updates.

Validation

• git diff --check
• YAML parse for .github/workflows/octocov.yml
• actionlint .github/workflows/octocov.yml
• bun install --frozen-lockfile
• bun run lint
• bun run test
• bun run build

Notes

bun run build completed successfully. It still reports existing declaration warnings from transitive dependencies, but the command exits successfully and this PR does not change build inputs.

[github-actions]

🎉 Happy commit!

• dogfooding: PR Pin octocov workflow actions #823 always celebrates.
• dogfooding: 9c71edd7d5a6a1a86eb1aa2c8b95075a53617b22 always celebrates.

[github-actions]

Code Metrics Report

	main (197c320)	#823 (5f02dda)	+/-
Coverage	99.0%	99.0%	0.0%
Code to Test Ratio	1:0.5	1:0.5	0.0
Test Execution Time	1s	1s	0s

Details

  |                     | main (197c320) | #823 (5f02dda) | +/-  |
  |---------------------|----------------|----------------|------|
  | Coverage            |          99.0% |          99.0% | 0.0% |
  |   Files             |              5 |              5 |    0 |
  |   Lines             |            107 |            107 |    0 |
  |   Covered           |            106 |            106 |    0 |
  | Code to Test Ratio  |          1:0.5 |          1:0.5 |  0.0 |
  |   Code              |           1386 |           1386 |    0 |
  |   Test              |            758 |            758 |    0 |
  | Test Execution Time |             1s |             1s |   0s |

---

Reported by octocov