ci: pin test workflow actions to immutable SHAs

[grtninja]

Summary

• pin actions/checkout in .github/workflows/tests.yml to an immutable SHA
• pin astral-sh/setup-uv in the same workflow to an immutable SHA
• preserve the existing test workflow behavior and job structure

Why

• reduces supply-chain drift in a security-relevant workflow surface
• keeps the change intentionally tiny and contributor-safe
• avoids overlapping existing open PRs on other Hermes workflow files

Validation

• git diff --check
• python -c "import pathlib, yaml; p=pathlib.Path(r'C:\Users\Eddie\.codex\worktrees\hermes-agent-tests-ci-pin\.github\workflows\tests.yml'); yaml.safe_load(p.read_text(encoding='utf-8')); print('yaml_ok', p)"
• queued local PC Control review-coder preflight before push on the staged diff

Risk Notes

• one-file change only
• no workflow logic changes
• no dependency or code-path changes

[teknium1]

Thanks @grtninja! Both action pins you added (actions/checkout@34e114876b... and astral-sh/setup-uv@d4b2f3b6...) are already on main at tests.yml lines 29, 35, 61, 64. Someone applied the same SHA pins earlier. Closing as redundant — great supply-chain hygiene thinking!

[alt-glitch]

Likely duplicate of #8318 — both pin GitHub Actions to SHA in CI workflows. #9801 (merged) already covered comprehensive supply chain hardening.