ci: pin the grader to a stable branch name

[lassebenni]

What I built

Repoints grade-assignment.yml from lassebenni/github-actions-fork@fix/allow-unsafe-pr-checkout-for-autograde to @stable/hyf-auto-grade, and rewrites the stale comment above it.

The old pin was labelled "Temporary pin ... Revert to HackYourFuture/github-actions@main after [PR #4]". That PR is closed without merge, so the pin is permanent. A branch named fix/... reads as disposable, and deleting or force-pushing it would silently break autograding for weeks 11, 12 and 14 at the same time.

stable/hyf-auto-grade points at the identical commit (346f1ae8). No behaviour change.

How to review

• One file changed: .github/workflows/grade-assignment.yml
• Check the uses: line now ends in @stable/hyf-auto-grade
• Check the comment block no longer claims the pin is temporary

How to run

The old branch still exists, so this is safe to merge in any order across the three repos. Open any assignment PR and confirm the Grade Assignment check still runs and produces a score.

What reviewers should see (expected results)

• uses: line: lassebenni/github-actions-fork/.github/workflows/auto-grade.yml@stable/hyf-auto-grade
• Grade Assignment check runs to completion and scores as before
• On this PR specifically the grader reports fail, because the branch carries no student work and a bare starter scores 40/100. That is the correct result, not a regression.

Self-check

• Same target commit (346f1ae8), verified before pushing
• New ref confirmed reachable via the contents API
• Grader confirmed to run to completion on the new pin
• Old branch left in place, so nothing breaks mid-migration
• Merged by a human (not me)

🤖 Generated with Claude Code

[github-actions]

📝 HackYourFuture auto grade

Assignment Score: 40 / 100 ❌

Status: ❌ Not passed
Minimum score to pass: 60
🧪 The auto grade is experimental and still being improved

Test Details

=== Week 14 Autograder ===
  ✓ PASS  found main.bicep
  ✓ PASS  found modules/storage.bicep
  ✓ PASS  found docs/deploy_succeeded.txt
  ✓ PASS  found docs/what_if.txt
  ✓ PASS  found docs/portal_confirm.md
  ✓ PASS  found WRITEUP.md
  ✓ PASS  found AI_ASSIST.md
  ✓ PASS  found README.md
  ✓ PASS  Level 1: required files (20/20 pts)
  ✓ PASS  main.bicep has an @secure() parameter
  ✓ PASS  main.bicep calls a module
  ✓ PASS  declares a storage account resource
  ✓ PASS  declares a nested blob container resource
  ✗ FAIL  main.bicep missing param environment (Task 1)
  ✗ FAIL  missing Environment tag wiring — pass tags from main into the module (Task 1)
  ✗ FAIL  need a second nested container named curated (keep raw; Task 2)
  ⚠ WARN  only 1 nested container resource(s) — Task 2 expects raw + curated (count >= 2)
  ✓ PASS  Level 2: Bicep baseline + extensions (20/35 pts)
  ✗ FAIL  docs/deploy_succeeded.txt still empty or missing Succeeded/provisioningState
  ✗ FAIL  docs/what_if.txt still looks like the scaffold placeholder
  ✗ FAIL  docs/portal_confirm.md is still the scaffold stub — write 2-3 sentences from the portal
  ✓ PASS  Level 3: deploy evidence (0/25 pts)
  ✗ FAIL  WRITEUP.md is still too short or still the scaffold stub
  ✗ FAIL  AI_ASSIST.md is still too short or still the scaffold stub
  ✓ PASS  Level 4: write-up + AI report (0/20 pts)

Score: 40 / 100  (passing: 60)  pass=false