[Rayan-and-beyond]

Summary

• annotate all pinned actions/checkout SHAs as v4.4.0 without changing the immutable SHA
• add a dependency-free CI guard requiring exact semver comments beside full-SHA action pins

Validation

• verified actions/checkout tag v4.4.0 resolves to 11d5960a326750d5838078e36cf38b85af677262
• guard passes on the updated tree
• mutation check: changing one annotation back to # v4 is rejected
• git diff --check

Fixes #34

[Maxerns]

Thanks @Rayan-and-beyond this closes #34 correctly.

I verified the following:

• All 7 actions/checkout pins now carry the exact # v4.4.0 comment.
• The pinned SHAs themselves are unchanged.
• Upstream verification confirms that v4.4.0 resolves to the pinned SHA.
• The new guard job is appropriately scoped.
• It passes against the current tree.
• It correctly ignores the README’s non-semver comments.
• It rejects a reverted # v4 comment with a clear error.
• The commit is signed off.

Once CI runs green on the branch, ill merge.