chore(ci): pin all GitHub Actions to latest release SHAs

[dan2k3k4]

Summary

• Upgrade every GitHub Action to its latest release and pin it to the full commit SHA, with the release version as a trailing comment (e.g. actions/checkout@3d3c42e… # v7.0.1).
• SHA pinning protects against tag-rewrite supply-chain attacks (a compromised action repo can move a version tag, but not a commit SHA).

Notes

• All inputs in use were checked against the new majors — no workflow syntax changes were needed.
• Same change applied across the amazeeio polydock app repos; openclaw-lagoon-base was already fully pinned and current.

Greptile Summary

The PR replaces mutable GitHub Action tags and one older checkout commit with immutable SHAs for current releases, reducing exposure to tag-rewrite supply-chain attacks.

• Pins actions/checkout to v7.0.1 across dependency review, release, and test workflows.
• Pins shivammathur/setup-php to v2.37.2 in the test workflow.
• Preserves the existing workflow triggers, permissions, runners, inputs, and test commands.

Confidence Score: 5/5

The PR appears safe to merge, with no concrete workflow compatibility or action-reference defects identified.

The pinned commits correspond to the documented action releases, and the changed workflows retain compatible GitHub-hosted runners, inputs, permissions, and downstream commands.

Important Files Changed

Filename	Overview
.github/workflows/dependency-review.yaml	Updates the existing checkout v7.0.0 SHA to the verified v7.0.1 SHA without changing workflow behavior.
.github/workflows/release-button.yml	Replaces the mutable checkout v7 tag with the verified v7.0.1 commit while preserving full-history checkout.
.github/workflows/tests.yml	Pins checkout v7.0.1 and setup-php v2.37.2 to verified SHAs while retaining compatible PHP 8.4, extension, and coverage settings.

_{Reviews (1): Last reviewed commit: "chore(ci): pin all GitHub Actions to lat..." | Re-trigger Greptile}