fix: filenum_ctrl SIGABRT (#16233) + PosixIO fork _exit + CI action SHA pin (#16502)

* fix: PosixIO::call_command 中 fork 后 child 缺少 _exit 导致 unwind 进 parent 代码

当 execlp 失败时，child 分支走 `return std::nullopt`，该子进程会从
PosixIO::call_command 一路 unwind 回 AdbController::call_command 及其
caller，跟 parent 同时跑：

- 在 child 地址空间副本中释放 m_callcmd_mutex（caller 处持有的 unique_lock）
- 后续命中 `kill(m_child, SIGTERM)` 时 child 视角 m_child==0
  → POSIX `kill(0, SIG)` 给整个进程组发信号 → 把 parent 一并杀掉
- 析构时双 close 同一 fd 号（kernel 已重用给别处）→ 关掉 parent 的
  socket / log fd → 后续 read/write 错乱

查看 git 历史发现回归引入于 #7748（perf: update PosixIO::call_command, 2023-12）。
当时 perf 重构把 child 分支结尾的 `::exit(exit_ret)` 替换成
`Log.error(...) + return std::nullopt`。

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* ci: 将第三方 action 钉到 commit SHA，符合 GitHub 安全建议

https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-third-party-actions

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix: filenum_ctrl 中 std::filesystem 调用缺 error_code 导致 SIGABRT

Windows 上 debug 截图被另一进程占用时，std::filesystem 多个调用会抛 filesystem_error。
异常未被 filenum_ctrl / save_debug_image / AbstractTask::run 任一层
捕获，沿任务栈一路冒到 MaaCore 顶层（issue #16233）。

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* chore: 清理 PosixIO 子分支 execlp 死赋值

按 Sourcery review 清掉死代码。

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* chore: restore release package workflow

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.github/workflows/blame-ignore.yml

@@ -41,7 +41,7 @@ jobs:
 
       - name: Push changes
         if: ${{ steps.check_changes.outcome == 'failure' }}
-        uses: ad-m/github-push-action@master
+        uses: ad-m/github-push-action@d30dc2d070765d7e509df00c34c5fa2dd636ff74 # master as of 2026-05-06
         with:
           branch: ${{ github.ref }}
           github_token: ${{ secrets.MAA_RESOURCE_SYNC }}

.github/workflows/issue-ai-analysis.yml

@@ -33,7 +33,7 @@ jobs:
       # - https://github.com/MaaAssistantArknights/MaaAssistantArknights/blob/dev-v2/.claude/skills/maa-issue-log-analysis/SKILL.md
       - name: Analyze issue with AI
         id: analysis
-        uses: Misteo/ai-issue-analysis@main
+        uses: Misteo/ai-issue-analysis@c0b258aa9660a1efd7316c9ed6d9ef81f1ac734a # main as of 2026-05-06
         with:
           github-token: ${{ secrets.MAA_BOT_TOKEN }}
           copilot-github-token: ${{ secrets.COPILOT_GITHUB_TOKEN }}

.github/workflows/optimize-templates.yml

@@ -104,7 +104,7 @@ jobs:
 
       - name: Push changes
         if: steps.check_push.outputs.is_pr != 'True' && steps.commit_changes.outputs.have_commits == 'True' && github.repository_owner == 'MaaAssistantArknights'
-        uses: ad-m/github-push-action@master
+        uses: ad-m/github-push-action@d30dc2d070765d7e509df00c34c5fa2dd636ff74 # master as of 2026-05-06
         with:
           github_token: ${{ secrets.MAA_RESOURCE_SYNC }}
           branch: ${{ github.ref }}

.github/workflows/pre-commit-scheduled.yml

@@ -25,7 +25,7 @@ jobs:
 
       - name: Commit and push changes
         if: steps.pre-commit.outcome == 'failure' && github.repository_owner == 'MaaAssistantArknights'
-        uses: actions-js/push@master
+        uses: actions-js/push@5a7cbd780d82c0c937b5977586e641b2fd94acc5 # master as of 2026-05-06
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           message: "chore: Auto update by pre-commit hooks

.github/workflows/res-update-game.yml

@@ -306,7 +306,7 @@ jobs:
 
       - name: Push changes
         if: steps.add_files.outputs.have_commits == 'True'
-        uses: ad-m/github-push-action@master
+        uses: ad-m/github-push-action@d30dc2d070765d7e509df00c34c5fa2dd636ff74 # master as of 2026-05-06
         with:
           branch: ${{ github.ref }}
           github_token: ${{ secrets.MAA_RESOURCE_SYNC }}

.github/workflows/update-submodules.yml

@@ -21,7 +21,7 @@ jobs:
         run: bash ./.github/scripts/sync-optional-submodules.sh --remote src/MAAUnified src/MaaMacGui src/maa-cli
 
       - name: Commit and push changes
-        uses: actions-js/push@master
+        uses: actions-js/push@5a7cbd780d82c0c937b5977586e641b2fd94acc5 # master as of 2026-05-06
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           message: "feat: Update Submodules MAAUnified, MaaMacGui, maa-cli