ci: harden action pinning lint (#1545)

* ci: harden action pinning lint

* refactor: extract dockview review dialog slot

* test: cover action pinning edge cases

* fix: reject dynamic workflow action sources

* fix: normalize quoted workflow action refs

* test: cover quoted unpinned action refs

---------

Co-authored-by: root <root@kandev.ts.net>

scripts/opencode-code-review.test.sh

@@ -100,7 +100,7 @@ if [[ "$trusted_script_count" != "2" ]]; then
 fi
 pass "OpenCode review executes the parser script from the trusted base commit in both workflow paths"
 
-artifact_upload_count="$(count_occurrences 'uses: actions/upload-artifact@v4')"
+artifact_upload_count="$(count_occurrences 'uses: actions/upload-artifact@')"
 if [[ "$artifact_upload_count" != "2" ]]; then
   fail "OpenCode review artifacts are uploaded from both workflow paths"
 fi