improve: pin GitHub Actions in publish.yml to SHA commit hashes for supply-chain security

[Coding-Dev-Tools]

Automated improvement by dev-engineer.

• Pinned actions/checkout, actions/setup-python, and pypa/gh-action-pypi-publish to SHA commit hashes (consistent with ci.yml and pages.yml which already use SHA pins)
• Prevents supply-chain attacks from tag-mutation on these actions

[github-actions]

🤖 Automated Code Review

✅ Ruff Lint — No issues

⚠️ Ruff Format — Formatting needed

Would reformat: conftest.py
Would reformat: src/datamorph/cli.py
Would reformat: src/datamorph/converters.py
Would reformat: tests/test_cli_error_paths.py
Would reformat: tests/test_converters.py
Would reformat: tests/test_edge_cases.py
Would reformat: tests/test_validate.py
7 files would be reformatted, 2 files already formatted

✅ Secret Detection — Clean

✅ Large Files — Within limits

📊 Diff Stats — 1 file(s) changed

 .github/workflows/publish.yml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

---

Verdict: ⚠️ Warnings — Lint/format issues found. Recommend fixing before merge.

Automated by Coding-Dev-Tools/.github reusable workflow.