chore: restrict Actions allowed_actions policy

[jflowers]

Context

The governance scan (2026-08-21) flagged allowed_actions: all as Below Floor tier. Currently any third-party or marketplace action can run without restriction.

Action

Restrict allowed actions in:
https://github.com/organizations/unbound-force/settings/actions

Recommended setting: Allow select actions and reusable workflows with:

• Allow actions created by GitHub: checked
• Allow actions by Marketplace verified creators: checked
• Allow specified actions and reusable workflows: add any additional pinned SHAs as needed

All workflows in .github already use SHA-pinned actions. This setting enforces the restriction org-wide for all repos.

Acceptance Criteria

• allowed_actions is selected (not all) in the next governance scan
• All existing workflows continue to pass