build(ci): pin the tools these workflows install at runtime (#100)

A tool installed with `pip install <name>` or `npm install -g <name>` resolves to
whatever is newest at the moment the job runs. That is a dependency like any
other -- it executes in CI, and in some repos it feeds a publish -- but it was
outside the pinning survey, which only looked at package manifests.

Each pin carries a `# renovate:` comment, so it is tracked rather than merely
frozen. The custom manager in reqstool/.github picks them up and will raise the
upgrades as ordinary PRs.

Signed-off-by: Jimisola Laursen <jimisola@jimisola.com>

Author: jimisola

.github/workflows/build.yml

@@ -55,7 +55,8 @@ jobs:
         with:
           python-version: "3.13"
       - name: Install dependencies
-        run: pip install hatch
+        # renovate: datasource=pypi depName=hatch
+        run: pip install hatch==1.18.0
       - name: Build wheel (used by e2e tests via PIP_FIND_LINKS)
         run: hatch build --target wheel
       - name: Run tests

.github/workflows/lint.yml

@@ -14,7 +14,8 @@ jobs:
         with:
           python-version: "3.13"
       - name: Install pip package(s)
-        run: pip install hatch
+        # renovate: datasource=pypi depName=hatch
+        run: pip install hatch==1.18.0
       - name: Run black formatter check
         run: hatch run dev:black --check --verbose src tests
       - name: Run flake8 linter