Publish workflow uses mutable action tags (@v5) despite holding id-token: write and secrets

Summary

.github/workflows/publish.yml — the highest-privilege workflow in the repo — pins actions by mutable tag instead of commit SHA:

• Line 29: actions/checkout@v5
• Line 31: pnpm/action-setup@v5
• Line 33: actions/setup-node@v5
• Line 59: changesets/action@v1

This workflow holds id-token: write (npm OIDC trusted publishing), contents: write, and SENTRY_AUTH_TOKEN. A compromise of any of these action tags would yield npm publish access.

Inconsistency

Other workflows in this repo already pin full commit SHAs, e.g.:

• terminal-recording.yml:23,27,29,55,74
• action.yml:62,83,114,191

So the fix is consistent with existing practice — only the publish workflow was missed.

Suggested fix

Pin the four actions to full commit SHAs (same style as terminal-recording.yml). Optionally also add persist-credentials: false to the checkout step in publish.yml, which other workflows set but publish.yml does not.

Happy to send a PR if useful.