fix: pin workflow actions to commit SHAs and pin uv in book.yml (#48)

[tschm]

Closes #48

Acceptance criterion (verbatim): "no uses: line references a tag or branch and every setup-uv step pins uv."

What changed

• All 17 uses: lines across ci.yml, image.yml and book.yml now point at a full commit SHA, with the release in a trailing comment. Each SHA is the commit the previously used major tag pointed at today, so no action changes version. This PR freezes what was already running.

  Action	Was	Pinned to
  actions/checkout	v4	11d5960 v4.4.0
  actions/upload-artifact	v4	ea165f8 v4.6.2
  actions/upload-pages-artifact	v3	56afc60 v3.0.1
  actions/deploy-pages	v4	d6db901 v4.0.5
  astral-sh/setup-uv	v5	d4b2f3b v5.4.2
  docker/setup-qemu-action	v3	c7c5346 v3.7.0
  docker/setup-buildx-action	v3	8d2750c v3.12.0
  docker/login-action	v3	c94ce9f v3.7.0
  docker/metadata-action	v5	c299e40 v5.10.0
  docker/build-push-action	v6	10e90e3 v6.19.2

• book.yml's setup-uv step now pins version: "0.11.28", the same uv ci.yml pins in both its jobs.

Gates

• actionlint: clean
• check-jsonschema --builtin-schema vendor.github-workflows: ok
• The collector suite was not re-run: no code or config it reads changed. CI on this PR exercises the pinned actions for real.

Not addressed: the issue's "consider Dependabot for github-actions" is outside its done-when criterion. That's worth a follow-up, since SHA pins don't update themselves.

🤖 Generated with Claude Code