[theoephraim]

#1226 was branched before #1229 landed and reintroduced tag refs: six in build-cli-binaries-macos.yaml plus download-artifact@v8 in binary-release.yaml and release.yaml. This pins those to the same SHAs used elsewhere in the repo.

Once merged, the repo setting "Require actions to be pinned to a full-length commit SHA" can be enabled to keep this from regressing.

Supersedes #1233 (Dependabot bumping the one unpinned setup-node tag).

[pullfrog]

• Read PR diff and relevant workflow context
• Validate action pins and CI enforcement behavior
• Update review snapshot and submit review

  ^{｜ View workflow run ｜ via Pullfrog ｜ Using gpt-6.1-sol ｜ 𝕏}