ci: pin GitHub Actions to commit SHAs (1)

[mirkosalvato1-ctrl]

Why

Mutable Action tags (@v4, @main) can be retagged, which is a supply-chain risk.
This PR pins third-party Actions to full commit SHAs while keeping the tag in a comment.
Official actions/* tags are left unchanged (common maintainer preference).

Pins

• actions/github-script@v6 -> d7906e4ad0b1

Reference: GitHub docs on using third-party actions securely.

---

Summary by cubic

Pinned actions/github-script in .github/workflows/publish-pypi.yml to commit d7906e4ad0b1822421a7e6a35d5ca353c962f410 to prevent mutable tag retagging and improve supply-chain security. Keeps v6 in a comment for clarity.

^{Written for commit f8727b3. Summary will update on new commits.}

[cubic-dev-ai]

No issues found across 1 file

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Re-trigger cubic}