Pin GitHub Action references to commit SHAs

[thpierce]

Summary

Pin all GitHub Action references to full commit SHAs instead of mutable version tags to prevent supply chain attacks. This is a security best practice recommended by GitHub's security hardening guide.

Mutable version tags (e.g. @v2) can be moved to point to different commits, meaning a compromised upstream action could execute malicious code in our workflows. Pinning to commit SHAs ensures we always run the exact code we've reviewed.

Changes

Old Reference	New Reference	Hash	Version
actions/checkout@v4	actions/checkout@34e1148	34e114876b0b11c390a56381ad16ebd13914f8d5	v4.3.1
anthropics/claude-code-base-action@beta	anthropics/claude-code-base-action@e8132bc	e8132bc5e637a42c27763fc757faa37e1ee43b34	v0.063
aws-actions/application-observability-for-aws@v1	aws-actions/application-observability-for-aws@95bb59e	95bb59e4538ba9ef746805d8a2bbbe531ba2a728	v1.1.1
aws-actions/configure-aws-credentials@v4	aws-actions/configure-aws-credentials@7474bc4	7474bc4690e29a8392af63c5b98e7449536d5c3a	v4.3.1

Static Code Check

Added a static-code-checks job to release-build.yml that will fail PRs introducing mutable GitHub Action version references.