Pin the action references that exist only on this line

The pinning sweep was authored on the maintenance branch, so it only ever saw
that branch's workflow files. This line carries package-freebsd.yml, which does
not exist there, and a ci.yml job block that does not either, so nine references
came through the merge still on mutable tags. The guard that landed with the
sweep then did exactly what it is for and failed the branch.

Those nine are now pinned in the same form, including the third-party FreeBSD VM
action that executes the whole build inside an image it controls. Each SHA was
resolved from the upstream peeled tag and checked back against it.

The lesson is worth keeping with the guard rather than in a commit message: a
checker authored on the earliest branch is only as complete as that branch's
file set, and merging it upward gates files it has never swept.

.github/workflows/ci.yml

@@ -139,16 +139,16 @@ jobs:
     name: Android cross-check (aarch64)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
       - name: Install Rust toolchain (+ Android target)
-        uses: actions-rust-lang/setup-rust-toolchain@v1
+        uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1
         with:
           target: aarch64-linux-android
           components: clippy
           cache: false
           rustflags: ''
       - name: Cache Cargo registry + build
-        uses: actions/cache@v5
+        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5
         with:
           path: |
             ~/.cargo/registry
@@ -158,7 +158,7 @@ jobs:
           restore-keys: |
             ${{ runner.os }}-cargo-
       - name: Install cargo-ndk
-        uses: taiki-e/install-action@v2
+        uses: taiki-e/install-action@7f4eb899022d8fe70b20c4f3de697aa85c309026 # v2
         with:
           tool: cargo-ndk
       - name: Clippy the library for Android

.github/workflows/package-freebsd.yml

@@ -20,7 +20,7 @@ jobs:
       freebsd_package_version: ${{ steps.freebsd_version.outputs.freebsd_package_version }}
       freebsd_pkg_file_version: ${{ steps.freebsd_version.outputs.freebsd_pkg_file_version }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
           fetch-depth: 0
 
@@ -60,7 +60,7 @@ jobs:
     needs: determine-versioning
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
           fetch-depth: 0
 
@@ -68,7 +68,7 @@ jobs:
         run: echo "SOURCE_DATE_EPOCH=$(git log -1 --format=%ct)" >> "$GITHUB_ENV"
 
       - name: Build and smoke-install in FreeBSD VM
-        uses: vmactions/freebsd-vm@v1
+        uses: vmactions/freebsd-vm@83b151f58c6047089f4c80eb5ba2039d158ce093 # v1
         env:
           FREEBSD_PACKAGE_VERSION: ${{ needs.determine-versioning.outputs.freebsd_package_version }}
         with:
@@ -186,7 +186,7 @@ jobs:
           echo "PASS: $(basename "$PKG") matches the in-VM SHA-256 ($actual)"
 
       - name: Upload artifact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: fips_${{ needs.determine-versioning.outputs.freebsd_package_version }}_x86_64_freebsd
           path: |
@@ -209,7 +209,7 @@ jobs:
 
     steps:
       - name: Download FreeBSD artifacts
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
           path: dist
           merge-multiple: true