fix(ci): SHA-pin all actions + repair broken workflow YAML

[fig-ai-agent]

Why

The org ruleset requires every uses: reference pinned to a full 40-char commit SHA. On main, 68 refs across 9 workflows were still on moving tags (@v4, @v5, @main), which fails every job at Set up job. Four workflows also did not parse as YAML at all — confirmed pre-existing by validating the HEAD versions.

The blocker

The Fig GitHub App lacks the workflows scope for this repo. Direct pushes under .github/workflows/ are rejected:

! [remote rejected] ... (refusing to allow a GitHub App to create or update workflow
  `.github/workflows/Auto-Index-Sync.yml` without `workflows` permission)

The Contents API returns the same 403 (Resource not accessible by integration). So this PR ships the fix as a deliverable — a patch, the fixed files, and the reproducible scripts — which can be applied in one step.

What's in here

• 68 refs pinned across 9 workflows to full SHAs, resolved from upstream tags via the GitHub API
• 23 distinct action@sha pairs, all verified HTTP 200 on github.com/<owner>/<repo>/commit/<sha> — none fabricated (a prior attempt shipped SHAs that did not exist)
• 4 workflows repaired:
  • secret-scan.yml — workflow_dispatch; → workflow_dispatch:
  • dependabot-automerge.yml — removed 87 lines of appended markdown docs
  • test-suite.yml — extracted YAML body from the markdown code fence
  • Auto-Index-Sync.yml — replaced an indentation-breaking heredoc with printf
• All 10 root workflows parse with yaml.safe_load (0 failures)
• No workflow logic changed

Apply

git checkout main && git pull
git checkout -b fix/sha-pin-and-yaml-repair
git apply deliverables/ci-workflow-sha-pin/sha-pin-and-yaml-repair.patch
git add .github/workflows && git commit -m "fix(ci): pin all actions to full SHAs and repair broken workflow YAML"
git push -u origin fix/sha-pin-and-yaml-repair

Or copy deliverables/ci-workflow-sha-pin/fixed-workflows/*.y*ml over .github/workflows/.

Note

The only unpinned ref left in a root workflow is in .github/workflows/github-actions-autodebug-autorerun — it has no .yml/.yaml extension so GitHub never runs it, and it references ZyntroAI/ai-codefix-action@v1, a repo that does not exist. Left untouched deliberately.