ci: pin actions to SHA + single-source the playwright pin (audit B6/B4)

B6: pin every third-party action in the build/publish path to an immutable
commit SHA (a retagged actions/checkout or action-gh-release would otherwise
inject code into the binary users download). The other workflows (tests, webrtc,
launch-matrix) handle no secrets, so they're left on tags.

B4: the playwright pin lived in two workflow files with no shared source. Move
it to scripts/playwright_pin.txt that both read, so they can't drift. The drive
gate already ENFORCES playwright<->juggler compatibility (an incompatible pin
fails the launch/drive and nothing publishes); the file is the single bump point
when the juggler is re-synced.

.github/workflows/verify-assets.yml

@@ -67,7 +67,7 @@ jobs:
             extra: ''
     steps:
       - name: Checkout wrapper (for scripts/ci_drive_gate.py)
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with: { fetch-depth: 1 }
       - name: Download the release asset (draft releases included)
         shell: bash
@@ -82,10 +82,12 @@ jobs:
             --dir art
           ls -la art/
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with: { python-version: '3.11' }
       - name: Install Playwright driver (no bundled browser — we override executable_path)
-        run: python -m pip install --quiet "playwright==1.55.0"
+        # Single-source pin (see release.yml); the drive gate enforces juggler compat.
+        shell: bash
+        run: python -m pip install --quiet "playwright==$(cat scripts/playwright_pin.txt)"
       - name: Linux system deps for headless firefox
         if: matrix.kind == 'linux'
         run: sudo "$(which python)" -m playwright install-deps firefox