Pin third-party GitHub Actions to SHAs and update Codecov

[kvz]

Why:

Third-party GitHub Action tags can move after review. Pinning these references to full commit SHAs makes the workflow supply-chain input immutable and prepares the repo for stricter GitHub Actions allowlist policy.

What:

• Replaced floating third-party action refs with pinned commits.
• Updated Codecov to the current v6 action before pinning it.
• Left first-party, GitHub-owned, and already SHA-pinned actions unchanged.

Changed workflows:

• .github/workflows/ci.yml

Resolved refs:

• codecov/codecov-action@v5 -> codecov/codecov-action@75cd11691c0faa626561e295848008c8a7dddffe
• ruby/setup-ruby@v1 -> ruby/setup-ruby@afeafc3d1ab54a631816aba4c914a0081c12ff2f

Verification:

• git diff --check
• Ruby YAML parse for changed workflow files
• Confirmed replaced floating refs no longer appear in changed workflows

Follow-up update:

• codecov/codecov-action@v5 now resolves through the v6 commit codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f after v5 failed in Codecov CLI signature validation.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 99.02%. Comparing base (cbd03a2) to head (30d9eb8).

Additional details and impacted files

@@           Coverage Diff           @@
##             main      #76   +/-   ##
=======================================
  Coverage   99.02%   99.02%           
=======================================
  Files           9        9           
  Lines         308      308           
  Branches       44       44           
=======================================
  Hits          305      305           
  Misses          3        3           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.