CI: SHA-pin actions in .github/workflows/claude.yml (S7637)

[bluet]

Goal

Pin the GitHub Actions referenced by tag in .github/workflows/claude.yml to full commit SHAs. SonarCloud githubactions:S7637 flags this as a supply-chain hygiene concern.

Why

Action tags are mutable — an upstream maintainer (or a compromised account) can re-tag @v1 to point at malicious code, and our workflow would silently fetch it on next run. SHA-pinning means we run exactly the bytes we audited at adoption time.

This pattern is already established in the project (.github/workflows/docker-publish.yml was SHA-pinned in PR #204; Dependabot's grouped monthly bumps from PR #207 keep the pins fresh).

Scope

# Before
uses: anthropics/claude-code-action@v1

# After (with comment for human readability of the version)
uses: anthropics/claude-code-action@<full-40-char-sha>  # v1

Apply to every uses: entry in .github/workflows/claude.yml that currently references a tag/branch instead of a SHA. Use gh api or visit the action's tags page to resolve each tag → SHA.

Acceptance criteria

1. grep 'uses:' .github/workflows/claude.yml shows ONLY 40-char SHA references.
2. SonarCloud githubactions:S7637 no longer flags lines in claude.yml.
3. Dependabot's grouped monthly bumps will keep the pins current (existing config in .github/dependabot.yml).

Effort

~5 minutes.