chore: update GitHub STS action

[sds]

Summary

• Pin the GitHub STS action to 8819cf80bdcb39c36c34700e3f2ecc08bde54f23.
• Route post-job token revocation through STS so GitHub and the D1 ownership ledger are updated together.
• Retain the action’s direct GitHub revocation fallback and ledger reconciliation.

Previous action revisions revoked tokens directly at GitHub, leaving their STS rows marked active until expiration.

Validation

• actionlint on the changed workflows
• git diff --check