fix(ci): verify pinned action version comments

[QinXi-ai]

Fixes #369.

Pinned actions could carry stale version comments without any gate noticing. Add scripts/verify-action-pins.sh, adapted from maintainer-agent, to compare each pin against its claimed tag, peel annotated tags (including nested tags), and report explicitly marked branch references separately. API/ref resolution errors fail with a different verdict from SHA mismatches.

The YAML input helper preserves every occurrence, handles subpaths, spacing, continuation lines and flow mappings, and rejects empty or unreadable input. It does not change the release rehearsal extractor owned by #441/#442/#444. CI and the local hygiene group both require the verifier; the CI step receives a read-only workflow token. Local runs require authenticated gh, Python 3 and PyYAML.

Correct the comments and replace moving major-alias comments with the exact release tags matching the existing commits. All 54 action SHA pins and the local reusable-workflow reference are unchanged. Deliberate branches are marked stable (branch) / main (branch).

Validation on Windows/Git Bash:

• Offline regression fixtures passed: mismatched/corrected comments, exact verdict counts, nested annotated tags, repository subpaths, explicit branches, missing comments/refs, empty input, malformed YAML and unreadable workflow inputs.
• Live GitHub API verification passed: 54 verdicts (46 tag matches, 8 explicit branch references).
• Local gate regression tests: 5 passed, including verifier failures becoming hard failures.
• ShellCheck at warning severity, workflow yamllint, and git diff --check passed.
• Full release rehearsal and Rust workspace validation were not run: this host has no Cargo. No Rust code or test baseline changed.