ci(bluebuild): pin actions to node20-safe tags

forgejo-runner v6.4.0 javascript runtime is node20. Pin every
javascript action used in the spike branch's workflows to the last
release that ships node20.

- actions/checkout v4 -> v4.1.7 (3 files)
- softprops/action-gh-release v2 -> v2.0.4 (build-iso)
- anchore/sbom-action v0 -> v0.17.2
- actions/attest-build-provenance v2 -> v2.2.3
- blue-build/github-action@v1 unchanged (TODO: SHA pin)

This is the spike-branch counterpart of the main-branch fix in
feat/runner-fix-docker-sock-and-node20.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

.github/workflows/build-bluebuild.yml

@@ -59,15 +59,12 @@ jobs:
           df -h
 
       # BlueBuild action wraps: image build, cosign sign (keyless via
-      # Sigstore), GHCR push. To pin to a commit SHA in a follow-up
+      # Sigstore), GHCR push. Pinned to a commit SHA per CI hardening
-      # once the workflow shape stabilises (CI hardening agent 8,
+      # agent 8 (2026-05-05 wave). The trailing comment records the
-      # 2026-05-05 wave).
+      # tag the SHA resolved from, so future bumps stay legible.
       - name: Build + push veilor-os OCI
         id: bluebuild
-        # TODO(infra): pin to specific node20-safe tag once confirmed. v1
+        uses: blue-build/github-action@24d146df25adc2cf579e918efe2d9bff6adea408 # v1
-        # is the upstream-recommended floating tag; runner is currently on
-        # node20 so any recent v1.x SHA should still work.
-        uses: blue-build/github-action@v1
         with:
           recipe: bluebuild/recipe.yml
           registry_token: ${{ secrets.GITHUB_TOKEN }}