chore(ci): monthly GitHub Action SHA refresh (2026-04)

[github-actions]

Automated monthly reminder to refresh pinned GitHub Action SHAs.

Use issue template: .github/ISSUE_TEMPLATE/ci-sha-refresh.md.

Checklist:

• Review .github/workflows/*.yml for pinned uses: refs
• Refresh SHAs for approved tags/branches
• Open PR with updates and confirm CI green