Pin GitHub Actions and cap uv deps

[tconley1428]

Summary

• pin GitHub Actions workflow refs to immutable commit SHAs
• pin temporalio reusable workflow references to immutable SHAs
• add a rolling uv exclude-newer policy with an openai-agents override

Testing

• rg -n "uses:\s*[^#\n]+@(main|master|v[0-9]+|stable)\b|OMES_REF:\s*(main|master)\b" .github/workflows -g '.yml' -g '.yaml'
• uv sync --dry-run

[Sushisource]

Thanks!