chore(agents-md): require SHA-pin for third-party GitHub Actions

AGENTS.md

@@ -198,10 +198,13 @@ before any of the rules below.
 
 - Every workflow has a top-level `permissions:` block. Default to
   `contents: read`. Widen per-job only when needed.
-- Track third-party actions at their latest stable tag (`@v4`).
-  Dependabot bumps the tag when a new major lands; review the
-  changelog and merge. Pin to SHA only when an action's repo has had
-  a tag-moving incident.
+- All third-party GitHub Actions (anything not under `actions/*` or
+  `github/*`) must be pinned to a full commit SHA with a `# vX.Y.Z`
+  comment. The comment lets Dependabot keep bumping the SHA. SHA
+  pinning prevents a tag from being silently rewritten to a
+  malicious commit by a compromised maintainer account.
+- GitHub-owned actions (`actions/*`, `github/*`): tag (`@v4`) is
+  acceptable; SHA pin preferred for defense-in-depth.
 - Never interpolate user-controlled input directly into `run:`
   blocks. Pipe through `env:`: