Pin third-party GitHub Actions to SHAs and limit editor-copy publishing

[kvz]

Why:

Third-party GitHub Action tags can move after review. Pinning these references to full commit SHAs makes the workflow supply-chain input immutable and prepares the repo for stricter GitHub Actions allowlist policy.

What:

• Replaced floating third-party action refs with the commits they currently resolve to.
• Left first-party, GitHub-owned, and already SHA-pinned actions unchanged.
• Granted contents: write to the editor-copy workflow, which already pushes generated GitHub Pages output.

Changed workflows:

• .github/workflows/archive.yml
• .github/workflows/ghpages.yml
• .github/workflows/publish.yml
• .github/workflows/update.yml

Resolved refs:

• martinthomson/i-d-template@v1 -> martinthomson/i-d-template@d2ce969b54014edf5671856b6866866c258bf8f5

Verification:

• git diff --check
• Ruby YAML parse for changed workflow files
• Confirmed replaced floating refs no longer appear in changed workflows

Follow-up update:

• The push-triggered editor-copy job failed when updating gh-pages; added explicit contents: write for that workflow and re-pushed.

Follow-up update:

• Limited generated gh-pages publishing to main pushes. Pull requests still build and upload artifacts, but feature-branch pushes no longer try to publish unsigned generated commits.