ci: pin connector-host branch Actions to full SHAs (#511)

[James3014]

Refs #511 and unblocks the connector-host completion checks in PR #513.

The nexus/connector-host-v1 branch still has two tag-based CI Actions even though repository policy requires immutable full-length commit SHAs. Pin the two existing Actions in .github/workflows/ci.yml to the same verified commits already used on the repository's main. No job logic, permissions, triggers or protected checks change. The patch stays confined to .github/workflows/ci.yml: two immutable Action pins, plus shell: bash for the existing Test step because the connector-host package test script uses POSIX export and Windows cmd.exe rejects it. No tests, test selection, permissions, triggers or branch rules are removed.

Verification must include real GitHub Actions and Nexus Core issue completion on this exact head. This PR does not close #511 or certify #1384's live concurrency pilot.

[James3014]

#511 / Nexus-new #1384 — exact-head CI reconciliation (2026-10-13)

Disposition: BLOCKED; not merge-eligible, not a completed AC11 pilot.

Subject: James3014/devspace PR #514 head bf10fa75e08a3b1e73a9c10b09013dc82ec75525, base cf62a6b0f627c754e00a1ebd608309d06ff910fe, target nexus/connector-host-v1.

• Real Actions run 38402165395 on this head: Ubuntu Smoke success, macOS Smoke success, Windows Smoke failure. The initial two SHA pins allowed runner startup; actions/checkout@v4 and actions/setup-node@v4 were no longer blocked by the repository's immutable-SHA policy.
• Windows job 115312274057 ran the outer Test step with shell: bash, but npm's internal Windows script shell still invoked cmd.exe and failed on the unchanged package.json script export DEVSPACE_CONFIG_DIR=.... Do not treat a Bash outer shell as a passing Windows test. A narrowly scoped npm script-shell fix is required and must be proven on a new exact head. The attempted additional edit did not land; the GitHub branch remains at bf10fa75e08a3b1e73a9c10b09013dc82ec75525.
• Core issue-completion run 38401621915, first pin-only head fa1c21dc5f168962f70d0bcc3d6e775787f1a8ab, failed nexus-certify issue-init with CONFIG_MISSING: run nexus-certify init first; no signed receipt was produced. The connector-host target line has no .nexus-core/config.toml. This Core defect is not proven resolved on the current head; do not copy main's divergent config (which references npm run verify:nexus-core) or bypass Core.
• Feature PR #513 remains open at f2ee9144460713685d057b7408a842c5021d6c64; its body now binds DevSpace Issue connector-host: align completion generation budget with Nexus-new loop (5) and track TEST_IMPACT revalidation (Nexus-new#1384) #511. Nexus-new feature #2068 remains open at baf935dcad925b722b2da7cdacf596ef9164ce04. Independently run: feat: read_head_check_runs completion port method (Nexus-new #2068) #513 bridge/real model 8/8 Python tests; #2068 Completion Loop 111/111 Python tests. Those are bounded test results, not deployed end-to-end acceptance.
• Nexus-new #1384 AC11 still lacks a real, validly authorized single-caller high-concurrency protected-merge pilot with zero reacceptances and post-CAS readback. Keep connector-host: align completion generation budget with Nexus-new loop (5) and track TEST_IMPACT revalidation (Nexus-new#1384) #511 and #1384 open.

Next gate: fix the owning connector-host CI shell and Core enrollment contracts without weakening checks, obtain terminal exact-head CI, then independently qualify #513/#2068 and only then attempt the authorized AC11 pilot. No forced merge/rebase, Gateway activation, or pilot was performed in this reconciliation.