Pin GitHub Actions to SHAs [SRE-1802]

[tylergohl]

Summary

Pin GitHub Actions references in this repo to immutable commit SHAs (with the original tag/branch preserved in a trailing comment). Part of SRE-1802 — org-wide supply-chain hardening.

Scope

This PR pins:

• Internal ctrliq/* reusable workflow and action references
• External actions not handled by clo-ciq's parallel Node 20 effort

No actions in this repo were claimed by clo-ciq's effort — this PR pins everything.

Files touched

• .github/workflows/stage.yml

Test plan

• Workflow runs succeed on this branch (or on next trigger after merge)
• Once this and any companion clo-ciq PR merge, this repo has zero unpinned external/internal refs and sha_pinning_required can be enabled on it

[Copilot]

Pull request overview

This PR hardens the GitHub Actions supply chain by pinning an unpinned action reference in the stage release workflow to an immutable commit SHA (SRE-1802).

Changes:

• Pin actions/create-release in the stage workflow from a moving tag (@v1) to a specific commit SHA, with an inline version note.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.