ci: pin publish workflow actions to commit SHAs

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Author: LukasParke

.github/workflows/sdk_publish.yaml

@@ -30,7 +30,7 @@ jobs:
     name: Publish to PyPI
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
 
       - name: Resolve release version
         id: version
@@ -65,7 +65,7 @@ jobs:
 
       - name: Install uv
         if: steps.pypi.outputs.published == 'false'
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5.4.2
 
       - name: Build
         if: steps.pypi.outputs.published == 'false'