docs: document actions pinning policy

[CoderDeltaLAN]

Summary:

• Documents the accepted GitHub Actions pinning policy decision for this repository.
• Adds implementation guardrails for future full-length SHA pinning without changing workflow action references in this phase.
• Updates the existing supply-chain evaluation record and CHANGELOG.

Scope:

• Documentation-only supply-chain policy decision.
• No workflow action references changed.
• No release, tag, PyPI, branch protection, runtime behavior, dependency, Scorecard, or CodeQL changes.

Validation:

• Local checks passed: 165 tests, ruff, text hygiene, git whitespace.
• Post-release audit passed after commit.
• Strong pre-push passed.
• Diff reviewed and staged exactly.

Risk:

• Low runtime risk because this phase does not change CI execution or product behavior.
• Follow-up SHA pinning implementation must preserve sub-action paths exactly.

Rollback:

• Revert this PR if the policy needs to be withdrawn or rewritten before v0.4.0.