fix(release): SHA-pin checkout and setup-node actions

PR #104 review (Claude, 2nd round — last remaining item):

upload-artifact / download-artifact / attest-build-provenance는 이미
SHA pin됐으나 checkout / setup-node가 floating @v6 tag로 남아
supply-chain 강화의 일관성 빈틈이었음.

- actions/checkout@v6 → de0fac2 (v6.0.2), build + release job 양쪽
- actions/setup-node@v6 → 48b55a0 (v6.4.0)

이제 워크플로우의 모든 action이 SHA pin. 입력 단계(checkout/node)가
오염되면 그 뒤 attestation이 변조된 빌드를 정상으로 서명하게 되므로
입력 단계 pin도 artifact 단계와 동등하게 중요.

.github/workflows/release.yml

@@ -20,14 +20,16 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v6
+      # SHA-pinned (v6.0.2) — all actions pinned for supply-chain consistency.
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
         with:
           # Don't leave GITHUB_TOKEN in .git/config where postinstall
           # scripts could pick it up.
           persist-credentials: false
 
       - name: Use Node.js
-        uses: actions/setup-node@v6
+        # SHA-pinned (v6.4.0).
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
         with:
           node-version: "20.x"
 
@@ -63,7 +65,8 @@ jobs:
       id-token: write
       attestations: write
     steps:
-      - uses: actions/checkout@v6
+      # SHA-pinned (v6.0.2).
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
         with:
           persist-credentials: false