fix(ci): replace invalid Actions pin with the commit SHA it resolves to

[MGPOCKY]

Problem

These workflow uses: pins are invalid as written. Each item below shows the current value, why it is wrong, and the correct ref that must be used instead.

1. .github/workflows/agent-android-bot.yml

Current (invalid):

uses: anthropics/claude-code-action@bf4f0de6fccd1eea7044a5f903fc928aff363134 # v1

Why this is wrong:

• bf4f0de6fccd1eea7044a5f903fc928aff363134 is not a commit SHA. It is the Git object SHA of an annotated tag (v1).
• GitHub Actions does not accept annotated tag object SHAs in uses: pins (Commits API returns No commit found for SHA).
• The correct pin is the commit SHA that tag v1 points to: df37d2f0760a4b5683a6e617c9325bc1a36443f6.

Correct pin:

uses: anthropics/claude-code-action@df37d2f0760a4b5683a6e617c9325bc1a36443f6 # v1

2. .github/workflows/agent-bot.yml

Current (invalid):

uses: anthropics/claude-code-action@bf4f0de6fccd1eea7044a5f903fc928aff363134 # v1

Why this is wrong:

• bf4f0de6fccd1eea7044a5f903fc928aff363134 is not a commit SHA. It is the Git object SHA of an annotated tag (v1).
• GitHub Actions does not accept annotated tag object SHAs in uses: pins (Commits API returns No commit found for SHA).
• The correct pin is the commit SHA that tag v1 points to: df37d2f0760a4b5683a6e617c9325bc1a36443f6.

Correct pin:

uses: anthropics/claude-code-action@df37d2f0760a4b5683a6e617c9325bc1a36443f6 # v1

3. .github/workflows/agent-fix.yml

Current (invalid):

uses: anthropics/claude-code-action@bf4f0de6fccd1eea7044a5f903fc928aff363134 # v1

Why this is wrong:

• bf4f0de6fccd1eea7044a5f903fc928aff363134 is not a commit SHA. It is the Git object SHA of an annotated tag (v1).
• GitHub Actions does not accept annotated tag object SHAs in uses: pins (Commits API returns No commit found for SHA).
• The correct pin is the commit SHA that tag v1 points to: df37d2f0760a4b5683a6e617c9325bc1a36443f6.

Correct pin:

uses: anthropics/claude-code-action@df37d2f0760a4b5683a6e617c9325bc1a36443f6 # v1

4. .github/workflows/agent-triage.yml

Current (invalid):

uses: anthropics/claude-code-action@bf4f0de6fccd1eea7044a5f903fc928aff363134 # v1

Why this is wrong:

• bf4f0de6fccd1eea7044a5f903fc928aff363134 is not a commit SHA. It is the Git object SHA of an annotated tag (v1).
• GitHub Actions does not accept annotated tag object SHAs in uses: pins (Commits API returns No commit found for SHA).
• The correct pin is the commit SHA that tag v1 points to: df37d2f0760a4b5683a6e617c9325bc1a36443f6.

Correct pin:

uses: anthropics/claude-code-action@df37d2f0760a4b5683a6e617c9325bc1a36443f6 # v1

Test plan

• Each updated uses: ref resolves as a commit via the GitHub Commits API
• Relevant CI jobs on this branch look healthy