ci: pin privileged HK workflow actions

[Pigbibi]

Summary

• pin all third-party actions in the issue-writing monthly audit workflow to full commit SHAs
• pin github-script in the comment-minimization workflow to a full commit SHA
• add a contract test that prevents mutable tags from returning to privileged workflows

Validation

• 3 targeted tests passed
• actionlint 1.7.12 passed
• Ruff and git diff --check passed

No live permissions, broker behavior, audit dispatch policy, or strategy behavior is changed.