fix: pin actions to commit SHAs, fix deprecated set-output

Pin all GitHub Actions to immutable commit SHAs instead of mutable
tags (@master, @v1, @v2, etc). Replace deprecated ::set-output with
$GITHUB_OUTPUT. Add explicit permissions blocks.

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

Author: sionsmith

.github/workflows/auto-format.yml

@@ -62,9 +62,9 @@ jobs:
             [[ $SENDER ==  "osotopbot" ]] || git push
             # Set status to fail, because the push should trigger another status check,
             # and we use success to indicate the checks are finished.
-            printf "::set-output name=%s::%s\n" "changed" "true"
+            echo "changed=true" >> "$GITHUB_OUTPUT"
             exit 1
           else
-            printf "::set-output name=%s::%s\n" "changed" "false"
+            echo "changed=false" >> "$GITHUB_OUTPUT"
             echo "No changes detected"
           fi