[Jay Gordon (jaydestro)]

Summary

• Pin all 20 checkout, setup-python, and upload-artifact references across three workflows to verified full-length v7 commit SHAs.
• Retain # v7 comments for readability and align the README and contributor guidance with the pinning policy.
• Preserve all other workflow behavior.

Validation

• Resolved each v7 tag through the upstream GitHub API and confirmed it points directly to the pinned commit.
• Verified all 20 references use the expected 40-character SHA and version comment, with no other workflow changes.
• git diff --check passed.
• Application tests were not run; changes only affect action references and documentation.

[Copilot]

🟢 Approval recommended

No active review issues are reported for the workflow action SHA-pinning change.

No open issues 🎉

What changed in this PR

This PR makes FleetCharge’s workflow action references immutable by replacing release tags with full-length commit SHA pins, while preserving other workflow behavior.

Changes:

• Pin 20 checkout, Python setup, and artifact upload references across three workflows.
• Retain # v7 comments for readable version identification.
• Align the README and contributor guidance with the SHA-pinning policy.

File	Description
README.md	Documents SHA pinning for CI actions.
.github/​workflows/​emulator-ci.yml	Pins six action references in emulator and live-model jobs.
.github/​workflows/​azure-cd-example.yml	Pins checkout and Python setup in the deployment example.
.github/​workflows/​agentic-ci.yml	Pins 12 action references across agent testing jobs.
.github/​copilot-instructions.md	Requires full-length SHA pins with release-version comments.

_{Review effort: Balanced}