Pin setup-xcode action by commit SHA

[ITOrity]

Summary

• pin maxim-lobanov/setup-xcode to the reviewed immutable commit ed7a3b1fda3918c0306d1b724322adc0b8cc0a90
• add a least-privilege workflow that checks the release action pin when relevant files change
• add a Psych 3/4-compatible Ruby regression check that rejects mutable, duplicate, or unexpected setup-xcode references

Why

The release workflow executed maxim-lobanov/setup-xcode@v1 before Developer ID signing, notarization, Sparkle signing, and GitHub publication. Because v1 is mutable, an upstream ref change could alter code executed inside the credential-bearing release job without a FineTune repository change.

The pinned commit is the peeled target of both upstream v1 and v1.7.0 as verified on 2026-08-01. The existing xcode-version: latest-stable behavior is preserved.

Validation

• ruby -c scripts/test_release_action_pins.rb
• ruby scripts/test_release_action_pins.rb
• safe YAML parsing of both changed workflows
• exploit fixture using setup-xcode@v1 is rejected
• duplicate, alternate mutable ref, case-variant owner, and wrong full-SHA fixtures are rejected
• go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.7 .github/workflows/security-policy.yml
• upstream commit and tag identity checked through GitHub and git ls-remote
• exact patch integrity, reverse-apply check, and Codex Security verification passed

No credential-bearing production release was triggered. The existing mutable softprops/action-gh-release@v1 reference is a separate finding and is intentionally outside this focused patch.