chore: Harden CI workflow against supply chain attacks

[ava-silver]

Summary

• SHA-pin all GitHub Actions (actions/checkout, actions/setup-node) to prevent tag-based supply chain attacks
• Replace bash <(curl -s https://codecov.io/bash) with SHA-pinned codecov/codecov-action@v5 to avoid piping remote scripts
• Pin depcheck to a specific version (1.4.7) in global install

Context

Following the axios npm supply chain compromise, we are hardening CI workflows to reduce exposure to this class of attack. Unpinned GitHub Action tags can be moved to point at arbitrary code, and piping remote scripts (curl | bash) has no integrity verification. These changes ensure all external dependencies in CI are pinned to immutable references.

Follows up on #677 which added --immutable to yarn install.

Test plan

• CI passes with updated action versions and codecov integration

🤖 Generated with Claude Code

[ava-silver]

• chore: Harden CI workflow against supply chain attacks #678 👈 (View in Graphite)
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 77.69%. Comparing base (11fe0b8) to head (7e25ae7).
⚠️ Report is 174 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #678      +/-   ##
==========================================
- Coverage   79.82%   77.69%   -2.14%     
==========================================
  Files          12       12              
  Lines        1046     1112      +66     
  Branches      329      350      +21     
==========================================
+ Hits          835      864      +29     
+ Misses        142      118      -24     
- Partials       69      130      +61     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.