fix(ci): pin reusable workflow actions to SHA, bump to v7 and document the pinning policy - #37

This PR is awaiting a named-maintainer review of the current head commit. This is a policy gate, not a CI failure: the PR is mergeable once a named maintainer approves. Approvals of earlier commits do not count after new pushes. See CODEOWNERS or MAINTAINERS.md for the list of maintainers.