ci: pin Diagnostics checkout + checksum bazelisk on Diagnostics and Binding RC

[DecisionNerd]

Summary

bazel-diagnostics still uses a floating actions/checkout@v7 tag and an unchecked curl | chmod +x bazelisk install. Binding RC Linux Bazel lanes (python + node) use the same unchecked bazelisk install. Required bazel-bootstrap already pins checkout and verifies bazelisk SHA-256; these surfaces must match.

Acceptance criteria

• bazel-diagnostics checkout pinned to the same SHA as bootstrap (actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1)
• bazel-diagnostics Install Bazelisk uses checksum + shasum --check + sudo install -m 0755 (no bare chmod +x)
• Binding RC python and node Bazel lanes use the same checksum install pattern (linux-amd64)
• Binding RC contract test comment updated if it still claims bazelisk uses chmod +x
• Existing chmod-forbidding contract assertions still pass

Non-goals

• npm trusted publisher / token deletion
• Suite-membership gate relocation (separate issue)
• Classifier arm ordering
• Job timeouts

Source

Devinfra Audit Recheck Wave E / PR-B

Validation

• python3 scripts/ci/test-ci-storage-policy.py
• python3 scripts/ci/test-binding-release-candidate.py

[coderabbitai]

🔗 Related PRs

#208 - ci: minimize Blacksmith cache storage [merged]
#278 - fix(ci): retain certification evidence as artifacts [merged]
#316 - fix(release): retain Binding RC evidence without brace globs [merged]
#422 - build(bazel): model PyO3/napi cdylibs and packaging handoff (#7) [merged]
#427 - build(bazel): cut over CI Gate, retain rollback, retire PR Cargo sticky disks (#4) [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!