fix: supply chain hardening — pin actions, images, and fix secret logging

[thc1006]

Summary

Comprehensive supply chain hardening across 15 plugin files. Supersedes #498.

• Pin all GitHub Actions from @master/@main to stable release tags
• Update EOL actions (upload-artifact@v3 → @v4, codeql@v2 → @v3)
• Pin all :latest container images to specific version tags
• Fix secret logging in CI examples (echo → env var injection)
• Fix CRLF → LF line endings in deployment-engineer.md

Changes

Actions pinned (supply chain risk)

Action	Old ref	New ref	Files
aquasecurity/trivy-action	@master	@0.28.0	3
snyk/actions/node	@master	@0.4.0	2
SonarSource/sonarcloud-github-action	@master	@v3	1
dependency-check/Dependency-Check_Action	@main	@v6	1
actions/upload-artifact	@v3 (EOL)	@v4	5
github/codeql-action/upload-sarif	@v2	@v3	2
codecov/codecov-action	@v3	@v4	1

Images pinned (reproducibility)

Image	Old tag	New tag
bitnami/kubectl	:latest	:1.31
prom/prometheus	:latest	:v3.2
jaegertracing/all-in-one	:latest	:1.62
grafana/tempo	:latest	:2.7
vault	:latest	:1.17
trufflesecurity/trufflehog	:latest	:3.88
sonarqube	:latest	:10.8-community
aquasec/trivy	:latest	:0.58.0
ghcr.io/astral-sh/uv	:latest	:0.6
temporalio/auto-setup	:latest	:1.26
temporalio/ui	:latest	:2.33

Security fix

secrets-management/SKILL.md examples previously echoed secrets to CI logs:

# Before (leaks credentials)
echo "API Key: ${{ secrets.API_KEY }}"

# After (safe env var injection)
env:
  API_KEY: ${{ secrets.API_KEY }}
run: ./deploy.sh

Motivation

• @master/@main refs are mutable — a compromised upstream can inject malicious code (cf. tj-actions/changed-files compromise March 2025)
• upload-artifact@v3 reached EOL November 2024 and now returns errors
• :latest tags make builds non-reproducible and can break silently
• echo ${{ secrets.X }} teaches unsafe patterns that bypass log masking

Test plan

• Verify no remaining @master or @main Action refs
• Verify no remaining :latest in base images
• Verify secrets-management examples use env var pattern

[wshobson]

Spot-checked the action and image pins (all real and current), and verified the deployment-engineer.md churn is purely CRLF→LF normalization with no hidden content edits. Solid cleanup — thanks for the thorough pass. Merging.