ci: actions/checkout is pinned at three different majors (v3.6.0 / v4.3.1 / v6.0.2) — nix-hashes.yml mixes two in one file #160

Problem

This repo SHA-pins its GitHub Actions with version comments, but actions/checkout is pinned at three different major versions across the workflows, and actions/github-script at two:

Verified on main 6388e35b3f by enumerating every uses: line in .github/workflows/:

The v3.6.0 checkouts are the deploy and publish family: deploy.yml, deploy-changelog.yml, deploy-files.yml, deploy-posts.yml, deploy-update.yml, deploy-www.yml (1 each), publish-github-action.yml, publish-vscode.yml (1 each) and publish.yml (8).

Sharpest instance: .github/workflows/nix-hashes.yml mixes two majors in one file — line 51 checks out with v6.0.2 and line 107 with v4.3.1.

Why it matters

• checkout v3.6.0 runs on the deprecated Node 16 action runtime. GitHub currently force-runs it on a newer runtime with warnings; it is the version most exposed to a future runner removal breaking every deploy/publish workflow at once.
• Three pins for one action means three different behaviours (credential persistence defaults, fetch behaviour, error handling) depending on which workflow a maintainer is debugging, and security/bug fixes land only where someone happens to bump.
• This repo has repeatedly treated action-version consistency as worth fixing (e.g. CI: jules-daily-upstream-sync is the only workflow using a floating actions/checkout@v4 tag — every other action in the repo is SHA-pinned #136 aligned the one floating checkout tag; the sibling fork fixed the same class of skew in ci: release pipeline downloads with artifact v4 what its own jobs upload with v7 — checkout/upload/download majors skew across workflows openchamber#143).

Acceptance criteria

• Every actions/checkout use in .github/workflows/ resolves to ONE SHA pin with an accurate version comment. Recommended direction: retire v3.6.0 first by moving the deploy/publish family onto the repo-standard v4.3.1 pin (34e114876b0b11c390a56381ad16ebd13914f8d5); then decide whether the standard becomes v4.3.1 or v6.0.2 and align the remainder (including both sites in nix-hashes.yml) in the same pass.
• actions/github-script likewise aligned to one pin (v7.1.0 ×3 vs v8.0.0 ×1 in pr-management.yml:93).
• All edited workflows still parse as YAML, and at least one PR-triggered workflow that uses the new standard pin runs green in CI.
• A note in the PR body recording which pin was chosen as the standard and why, so the next bump has a single place to start from.

Scope / cross-repo check

Single-repo. The same enumeration in the sibling repos does not show this pattern: dezren39/nix is uniform (checkout v7.0.1 everywhere), developing-today/openchamber is uniform v7.0.1 apart from a jules-workflow straggler already covered by its PR #144, and developing-today/code uses floating major tags (a different, separately tracked convention).