ci: pin TypeScript workflow actions to immutable SHAs

[grtninja]

Summary

• pin the floating actions in .github/workflows/typescript.yml to immutable commit SHAs
• keep the patch scoped to the existing TypeScript workflow only
• preserve the current job matrix, publish flow, and permissions

Why

This workflow handles package publishing and uses NODE_AUTH_TOKEN, so pinning mutable action tags reduces GitHub Actions supply-chain risk without changing behavior.

Validation

• git diff --check
• python -c "import pathlib, yaml; p=pathlib.Path(r'.github/workflows/typescript.yml'); yaml.safe_load(p.read_text(encoding='utf-8')); print('yaml_ok', p)"

Notes

• no workflow logic changes
• no job/permission changes
• no overlap with the repo's current open workflow PRs on other files