chore(github-actions): pin reqstool/.github references to 1.0.0 (#113)

Replaces a mix of @main and @<sha> # main <date> with a single shape:
@<sha> # 1.0.0, against reqstool/.github's first tag.

@main is mutable, so CodeQL's actions/unpinned-tag flags it and any
change to the shared workflows reaches this repo with no review -- which
bit twice this week while the PyPI publish path was being fixed. A bare
tag would still be mutable; the sha-with-version-comment form satisfies
the pinning audits while letting Renovate track the digest and rewrite
the comment, so the pin does not rot.

Implements reqstool/.github#25.

Signed-off-by: Jimisola Laursen <jimisola@jimisola.com>

Author: jimisola

.github/workflows/build-docs.yml

@@ -15,4 +15,4 @@ permissions:
 
 jobs:
   build:
-    uses: reqstool/.github/.github/workflows/common-build-docs.yml@main
+    uses: reqstool/.github/.github/workflows/common-build-docs.yml@ef815eae0bca7160cdc714126cac73f76d638b39 # 1.0.0

.github/workflows/build.yml

@@ -31,18 +31,18 @@ jobs:
       - name: Build project
         run: mvn clean verify
       - name: Install reqstool
-        uses: reqstool/.github/.github/actions/install-reqstool@5bdf4e5c4af98274c44c8fbaa5b54d605a6cf38a # main 2026-06-22
+        uses: reqstool/.github/.github/actions/install-reqstool@ef815eae0bca7160cdc714126cac73f76d638b39 # 1.0.0
         with:
           reqstool-source: ${{ matrix.reqstool-source }}
       - name: Validate reqstool spec completeness
         # not yet available in the latest PyPI release
         if: matrix.reqstool-source == 'main'
-        uses: reqstool/.github/.github/actions/validate-reqstool@5bdf4e5c4af98274c44c8fbaa5b54d605a6cf38a # main 2026-06-22
+        uses: reqstool/.github/.github/actions/validate-reqstool@ef815eae0bca7160cdc714126cac73f76d638b39 # 1.0.0
       - name: Run reqstool status
-        uses: reqstool/.github/.github/actions/reqstool-status@5bdf4e5c4af98274c44c8fbaa5b54d605a6cf38a # main 2026-06-22
+        uses: reqstool/.github/.github/actions/reqstool-status@ef815eae0bca7160cdc714126cac73f76d638b39 # 1.0.0
         with:
           # this repo intentionally has incomplete requirements (it showcases every status outcome)
           fail-if-incomplete: "false"
 
   validate-openspec:
-    uses: reqstool/.github/.github/workflows/common-validate-openspec.yml@5bdf4e5c4af98274c44c8fbaa5b54d605a6cf38a # main 2026-06-22
+    uses: reqstool/.github/.github/workflows/common-validate-openspec.yml@ef815eae0bca7160cdc714126cac73f76d638b39 # 1.0.0

.github/workflows/check-semantic-pr.yml

@@ -10,4 +10,4 @@ permissions:
 
 jobs:
   check:
-    uses: reqstool/.github/.github/workflows/common-check-semantic-pr.yml@main
+    uses: reqstool/.github/.github/workflows/common-check-semantic-pr.yml@ef815eae0bca7160cdc714126cac73f76d638b39 # 1.0.0