Pin CI dependencies to exact versions and commit SHAs

The marketplace step installed @anthropic-ai/claude-code at whatever
latest resolved to, so the same commit could pass one day and fail
the next, and each run executed unreviewed new code on the runner.
The skills step already pinned 1.5.20; this makes the policy uniform.
Actions move from mutable tags to full commit SHAs per GitHub's
hardening guidance, with versions in trailing comments for bumps.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.github/workflows/validate.yml

@@ -12,11 +12,11 @@ jobs:
   check:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: 22
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: "3.12"
       - name: Check package files
@@ -25,5 +25,5 @@ jobs:
         run: npx --yes skills@1.5.20 add . --list
       - name: Check Claude marketplace
         run: |
-          npm install --global @anthropic-ai/claude-code
+          npm install --global @anthropic-ai/claude-code@2.1.237
           claude plugin validate .