[Bug] `/install-github-app`: Github Action Workflow Files Missing Dependency SHA Pinning

Bug Description
The workflow files created during /install-github-app slash command does not hash pin deps, causing installation to fail if Github Orgs require Secure References, i.e. full-length commit SHA action versions.

<img width="1296" height="391" alt="Image" src="https://github.com/user-attachments/assets/a0b87427-1a9d-4e3b-8ce2-69b2280f17a7" />

Root Cause:

I'd link to the lines of the cli directly, but the cli is closed sorce.

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4     # <--- This line causes issues
        with:
          fetch-depth: 1

      - name: Run Claude Code Review
        id: claude-review
        uses: anthropics/claude-code-action@v1      # <--- This line causes issues

<img width="1046" height="606" alt="Image" src="https://github.com/user-attachments/assets/baf99656-529c-4f65-ac83-cc38a5d3e11d" />

Suggested patch:

This should be replaced with a hash-pinned version sourced directly from https://github.com/actions/checkout & https://github.com/anthropics/claude-code-action repos.

e.g.

    steps:
      - name: Checkout repository
        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0

      - name: Run Claude Code Review
        id: claude-review
        uses: anthropics/claude-code-action@a3ff61d47aa5118a43b33ae44c4087d9eb51111a #  v1

or

    steps:
      - name: Checkout repository
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5

      - name: Run Claude Code Review
        id: claude-review
        uses: anthropics/claude-code-action@a3ff61d47aa5118a43b33ae44c4087d9eb51111a #  v1