ci: fix three unresolvable pinned action SHAs

Dependabot pinned SHAs that do not exist in the upstream repos, breaking
Semantic Release, dev-pypi, and prod-release:

- actions/download-artifact @v4 -> d3f86a1 (was fa0a91b, not found)
- astral-sh/setup-uv @v7 -> 37802ad commit (was 94527f2, a tag OBJECT sha,
  not a commit — Actions requires a commit sha)
- oven-sh/setup-bun @v2 -> 0c5077e (was 735343b, not found)

All other pinned SHAs verified against the GitHub API.

Author: fgogolli

.github/actions/setup-uv-cached/action.yml

@@ -13,7 +13,7 @@ runs:
   using: 'composite'
   steps:
     - name: Install UV
-      uses: astral-sh/setup-uv@94527f2e458b27549849d47d273a16bec83a01e9  # v7
+      uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78  # v7
 
     - name: Restore UV environment
       id: restore-cache

.github/actions/setup-uv-fresh/action.yml

@@ -21,7 +21,7 @@ runs:
         python-version: ${{ inputs.python-version }}
 
     - name: Install UV
-      uses: astral-sh/setup-uv@94527f2e458b27549849d47d273a16bec83a01e9  # v7
+      uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78  # v7
       with:
         version: "0.9.6"
         enable-cache: true

.github/workflows/dev-pypi.yml

@@ -89,7 +89,7 @@ jobs:
         fail-on-cache-miss: false
 
     - name: Setup Bun (for UI static bundle)
-      uses: oven-sh/setup-bun@735343b667d3e6f658f44d0eca948eb6282f4b11  # v2
+      uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6  # v2
       with:
         bun-version: "1.2.15"  # pinned; update intentionally to avoid surprise breakage
 

.github/workflows/prod-release.yml

@@ -62,7 +62,7 @@ jobs:
         fail-on-cache-miss: false
 
     - name: Setup Bun (for UI static bundle)
-      uses: oven-sh/setup-bun@735343b667d3e6f658f44d0eca948eb6282f4b11  # v2
+      uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6  # v2
       with:
         bun-version: "1.2.15"  # pinned; update intentionally to avoid surprise breakage
 
@@ -114,7 +114,7 @@ jobs:
         password: ${{ secrets.GITHUB_TOKEN }}
 
     - name: Download release wheel
-      uses: actions/download-artifact@fa0a91b85d4f404e444306234a8ac7fed6c1d3f4  # v4
+      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093  # v4
       with:
         name: release-wheel-${{ needs.config.outputs.package-version }}
         path: dist/
@@ -228,7 +228,7 @@ jobs:
         fail-on-cache-miss: false
 
     - name: Download release wheel
-      uses: actions/download-artifact@fa0a91b85d4f404e444306234a8ac7fed6c1d3f4  # v4
+      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093  # v4
       with:
         name: release-wheel-${{ needs.config.outputs.package-version }}
         path: dist/
@@ -324,7 +324,7 @@ jobs:
         fail-on-cache-miss: false
 
     - name: Download release wheel
-      uses: actions/download-artifact@fa0a91b85d4f404e444306234a8ac7fed6c1d3f4  # v4
+      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093  # v4
       with:
         name: release-wheel-${{ needs.config.outputs.package-version }}
         path: dist/

.github/workflows/semantic-release.yml

@@ -113,7 +113,7 @@ jobs:
         uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990  # v8.3.2
 
       - name: Setup Bun (for UI static bundle)
-        uses: oven-sh/setup-bun@735343b667d3e6f658f44d0eca948eb6282f4b11  # v2
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6  # v2
         with:
           bun-version: "1.2.15"  # pinned; update intentionally to avoid surprise breakage