chore(ci): make reusable workflow internal action references immutable

[ClaudiaFang]

Context

_cf-worker-template.yml can be consumed through an immutable release such as @v1.5.0, but it still invokes repository-local composite actions through floating @v1 references such as actions/setup@v1 and actions/normalize-branch-alias@v1.

That means a consumer pinned to @v1.5.0 can still change behavior later when floating v1 moves.

Goal

• make released reusable workflow behavior reproducible
• avoid floating internal action references inside immutable workflow releases
• preserve current public inputs/outputs and behavior
• establish a maintainable release convention for internal composite actions

Acceptance criteria

• a workflow pinned to a released tag does not indirectly execute newer floating internal action code
• branch alias normalization remains stable for an immutable release
• setup behavior remains stable for an immutable release
• current callers remain backward compatible
• release/versioning documentation explains the chosen strategy