ci: fix broken action SHAs and bump to latest major versions

Dependabot pinned SHAs that do not exist in the upstream repos, breaking
Semantic Release, dev-pypi, and prod-release.  Fixed and, where the repo
already used a newer major elsewhere, aligned these stragglers to it:

- actions/download-artifact: v4 (dead sha fa0a91b) -> v8 3e5f45b (latest;
  all usages are single-name downloads, unaffected by v5+ changes)
- astral-sh/setup-uv: v7 (94527f2 was a tag OBJECT sha, not a commit) ->
  v8.3.2 11f9893 (latest; matches the pin already used in semantic-release)
- oven-sh/setup-bun: v2 (dead sha 735343b) -> v2 0c5077e (latest v2)

All 39 pinned action SHAs across .github/ verified to resolve as commits.

Author: fgogolli

.github/actions/setup-uv-cached/action.yml

@@ -13,7 +13,7 @@ runs:
   using: 'composite'
   steps:
     - name: Install UV
-      uses: astral-sh/setup-uv@94527f2e458b27549849d47d273a16bec83a01e9  # v7
+      uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990  # v8.3.2
 
     - name: Restore UV environment
       id: restore-cache

.github/actions/setup-uv-fresh/action.yml

@@ -21,7 +21,7 @@ runs:
         python-version: ${{ inputs.python-version }}
 
     - name: Install UV
-      uses: astral-sh/setup-uv@94527f2e458b27549849d47d273a16bec83a01e9  # v7
+      uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990  # v8.3.2
       with:
         version: "0.9.6"
         enable-cache: true

.github/workflows/dev-pypi.yml

@@ -89,7 +89,7 @@ jobs:
         fail-on-cache-miss: false
 
     - name: Setup Bun (for UI static bundle)
-      uses: oven-sh/setup-bun@735343b667d3e6f658f44d0eca948eb6282f4b11  # v2
+      uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6  # v2
       with:
         bun-version: "1.2.15"  # pinned; update intentionally to avoid surprise breakage
 

.github/workflows/prod-release.yml

@@ -62,7 +62,7 @@ jobs:
         fail-on-cache-miss: false
 
     - name: Setup Bun (for UI static bundle)
-      uses: oven-sh/setup-bun@735343b667d3e6f658f44d0eca948eb6282f4b11  # v2
+      uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6  # v2
       with:
         bun-version: "1.2.15"  # pinned; update intentionally to avoid surprise breakage
 
@@ -114,7 +114,7 @@ jobs:
         password: ${{ secrets.GITHUB_TOKEN }}
 
     - name: Download release wheel
-      uses: actions/download-artifact@fa0a91b85d4f404e444306234a8ac7fed6c1d3f4  # v4
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8
       with:
         name: release-wheel-${{ needs.config.outputs.package-version }}
         path: dist/
@@ -228,7 +228,7 @@ jobs:
         fail-on-cache-miss: false
 
     - name: Download release wheel
-      uses: actions/download-artifact@fa0a91b85d4f404e444306234a8ac7fed6c1d3f4  # v4
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8
       with:
         name: release-wheel-${{ needs.config.outputs.package-version }}
         path: dist/
@@ -324,7 +324,7 @@ jobs:
         fail-on-cache-miss: false
 
     - name: Download release wheel
-      uses: actions/download-artifact@fa0a91b85d4f404e444306234a8ac7fed6c1d3f4  # v4
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8
       with:
         name: release-wheel-${{ needs.config.outputs.package-version }}
         path: dist/

.github/workflows/semantic-release.yml

@@ -113,7 +113,7 @@ jobs:
         uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990  # v8.3.2
 
       - name: Setup Bun (for UI static bundle)
-        uses: oven-sh/setup-bun@735343b667d3e6f658f44d0eca948eb6282f4b11  # v2
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6  # v2
         with:
           bun-version: "1.2.15"  # pinned; update intentionally to avoid surprise breakage