Keep the central GitHub Action allowlist synchronized with vetted dependency updates

[rmcdaniel]

Problem

The public control-plane qualification currently fails because Sample App uses the official actions/cache v6.1.0 commit while the central action policy still allows only v5. The Sample App landing is otherwise green, and the v6.1.0 tag resolves to the exact pinned, verified commit 55cc8345863c7cc4c66a329aec7e433d2d1c52a9 with the required Node 24 runtime.

This makes every new Beta candidate source qualification fail and causes scheduled component release-recovery workflows to reject the current recovery authority. A vetted dependency update must not be able to land without the matching central policy authority.

Acceptance criteria

• Add the exact official actions/cache v6.1.0 commit to the centralized allowed-release policy after validating its immutable tag, verified commit identity, and Node 24 runtime.
• Keep the prior v5 identity only where an existing protected workflow still legitimately consumes it; do not use mutable action tags.
• Add focused policy tests proving the exact v6.1.0 commit is accepted and an unknown or mutable cache reference is rejected.
• Add a preflight or cross-repository check that prevents future public action upgrades from landing while their exact commit is absent from the central allowlist.
• Run the full target-qualification audit against current public branches.
• Produce a green Beta candidate run for the repaired control-plane commit.
• Confirm at least one scheduled component release-recovery run accepts that qualified authority instead of failing during default-branch preflight.

Evidence

• Failing control-plane run: https://github.com/durable-workflow/.github/actions/runs/31675451678
• Green Sample App landing: durable-workflow/sample-app@04918bd