fix: narrow same-owner actions to patch versions too

The isSameOwner guard in applyPin was skipping patch-version narrowing
for all same-org actions (e.g. github/codeql-action in a github/* repo).
This meant codeql-action@v4 stayed as v4 instead of narrowing to v4.35.2.

The guard was redundant — IsMutableVersionTag already filters out
non-version refs like 'main', so default-branch pins were never
reaching this code path anyway.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: nodeselector

internal/doctor/apply.go

@@ -82,10 +82,6 @@ func (rem *Remediator) applyPin(wr WorkflowReport) error {
 		if !IsMutableVersionTag(dep.Ref) {
 			continue
 		}
-		// Skip internal actions pinned to default branch.
-		if rem.isSameOwner(strings.SplitN(dep.NWO, "/", 3)[0]) {
-			continue
-		}
 		parts := strings.SplitN(dep.NWO, "/", 3)
 		if len(parts) < 2 {
 			continue