fix: pin strfry image and fix health check in CI

Pin strfry Docker image to a specific digest to satisfy zizmor's
unpinned-images check. Replace broken health check (curl -sf fails on
HTTP 426 Upgrade Required) with status code check that accepts any
non-zero HTTP response as "ready".

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: matthiasdebernardini

.github/workflows/ci.yml

@@ -105,7 +105,7 @@ jobs:
       contents: read
     services:
       strfry:
-        image: ghcr.io/hoytech/strfry:latest
+        image: ghcr.io/hoytech/strfry@sha256:7cf3b97c66a8c3087e16e5d31a3bb8eb92312f08dd969ff3dced9625242ac55f # latest
         ports:
           - 7777:7777
     steps:
@@ -125,9 +125,9 @@ jobs:
       - name: Wait for strfry
         run: |
           for i in $(seq 1 30); do
-            if curl -sf -o /dev/null http://localhost:7777 2>/dev/null || \
-               curl -sf -o /dev/null -w '%{http_code}' http://localhost:7777 2>/dev/null | grep -qE '4[0-9]{2}'; then
-              echo "strfry is ready"
+            STATUS=$(curl -s -o /dev/null -w '%{http_code}' http://localhost:7777 2>/dev/null || true)
+            if [ "$STATUS" != "000" ] && [ -n "$STATUS" ]; then
+              echo "strfry is ready (HTTP $STATUS)"
               exit 0
             fi
             echo "Waiting for strfry... ($i/30)"