test(ci): pin passing action fixtures to SHAs

[alxxjohn]

Summary

• pin GitHub Action refs in CI success-path fixtures to full 40-character SHAs
• pin the configless folder-scan success fixture to a full SHA
• preserve mutable @v4 refs in tests that intentionally verify rejection

Root cause

The immutable-action-ref rule correctly rejects version tags, but several fixtures that expect a passing CI/CD result still used @v4, @v5, and @v7. Release Please regenerates its release branch from main, so fixing only the generated release branch is overwritten whenever main advances.

Verification

• GitHub compare: branch is 2 commits ahead of current main, 0 behind
• Diff scope: only tests/checks/ci_test.go and tests/cli/scan_test.go (8 replacements total)
• git diff --check passed locally
• The same fixture patch previously passed go test ./... and go vet ./...
• Fresh Go execution was unavailable in the current workspace because the Go binary is not installed; this PR's Actions run will provide fresh verification