fix: pin inputs (#17471)

## Summary
- Pin Rust git patch dependencies to immutable revisions and make
cargo-deny reject unknown git and registry sources unless explicitly
allowlisted.
- Add checked-in SHA-256 coverage for the current rusty_v8 release
assets, wire those hashes into Bazel, and verify CI override downloads
before use.
- Add rusty_v8 MODULE.bazel update/check tooling plus a Bazel CI guard
so future V8 bumps cannot drift from the checked-in checksum manifest.
- Pin release/lint cargo installs and all external GitHub Actions refs
to immutable inputs.

## Future V8 bump flow
Run these after updating the resolved `v8` crate version and checksum
manifest:

```bash
python3 .github/scripts/rusty_v8_bazel.py update-module-bazel
python3 .github/scripts/rusty_v8_bazel.py check-module-bazel
```

The update command rewrites the matching `rusty_v8_<crate_version>`
`http_file` SHA-256 values in `MODULE.bazel` from
`third_party/v8/rusty_v8_<crate_version>.sha256`. The check command is
also wired into Bazel CI to block drift.

## Notes
- This intentionally excludes RustSec dependency upgrades and
bubblewrap-related changes per request.
- The branch was rebased onto the latest origin/main before opening the
PR.

## Validation
- cargo fetch --locked
- cargo deny check advisories
- cargo deny check
- cargo deny check sources
- python3 .github/scripts/rusty_v8_bazel.py check-module-bazel
- python3 .github/scripts/rusty_v8_bazel.py update-module-bazel
- python3 -m unittest discover -s .github/scripts -p
'test_rusty_v8_bazel.py'
- python3 -m py_compile .github/scripts/rusty_v8_bazel.py
.github/scripts/rusty_v8_module_bazel.py
.github/scripts/test_rusty_v8_bazel.py
- repo-wide GitHub Actions `uses:` audit: all external action refs are
pinned to 40-character SHAs
- yq eval on touched workflows and local actions
- git diff --check
- just bazel-lock-check

## Hash verification
- Confirmed `MODULE.bazel` hashes match
`third_party/v8/rusty_v8_146_4_0.sha256`.
- Confirmed GitHub release asset digests for denoland/rusty_v8
`v146.4.0` and openai/codex `rusty-v8-v146.4.0` match the checked-in
hashes.
- Streamed and SHA-256 hashed all 10 `MODULE.bazel` rusty_v8 asset URLs
locally; every downloaded byte stream matched both `MODULE.bazel` and
the checked-in manifest.

## Pin verification
- Confirmed signing-action pins match the peeled commits for their tag
comments: `sigstore/cosign-installer@v3.7.0`, `azure/login@v2`, and
`azure/trusted-signing-action@v0`.
- Pinned the remaining tag-based action refs in Bazel CI/setup:
`actions/setup-node@v6`, `facebook/install-dotslash@v2`,
`bazelbuild/setup-bazelisk@v3`, and `actions/cache/restore@v5`.
- Normalized all `bazelbuild/setup-bazelisk@v3` refs to the peeled
commit behind the annotated tag.
- Audited Cargo git dependencies: every manifest git dependency uses
`rev` only, every `Cargo.lock` git source has `?rev=<sha>#<same-sha>`,
and `cargo deny check sources` passes with `required-git-spec = "rev"`.
- Shallow-fetched each distinct git dependency repo at its pinned SHA
and verified Git reports each object as a commit.

.github/scripts/rusty_v8_bazel.py

@@ -4,6 +4,7 @@ from __future__ import annotations
 
 import argparse
 import gzip
+import hashlib
 import re
 import shutil
 import subprocess
@@ -12,8 +13,16 @@ import tempfile
 import tomllib
 from pathlib import Path
 
+from rusty_v8_module_bazel import (
+    RustyV8ChecksumError,
+    check_module_bazel,
+    update_module_bazel,
+)
+
 
 ROOT = Path(__file__).resolve().parents[2]
+MODULE_BAZEL = ROOT / "MODULE.bazel"
+RUSTY_V8_CHECKSUMS_DIR = ROOT / "third_party" / "v8"
 MUSL_RUNTIME_ARCHIVE_LABELS = [
     "@llvm//runtimes/libcxx:libcxx.static",
     "@llvm//runtimes/libcxx:libcxxabi.static",
@@ -146,6 +155,24 @@ def resolved_v8_crate_version() -> str:
     return matches[0]
 
 
+def rusty_v8_checksum_manifest_path(version: str) -> Path:
+    return RUSTY_V8_CHECKSUMS_DIR / f"rusty_v8_{version.replace('.', '_')}.sha256"
+
+
+def command_version(version: str | None) -> str:
+    if version is not None:
+        return version
+    return resolved_v8_crate_version()
+
+
+def command_manifest_path(manifest: Path | None, version: str) -> Path:
+    if manifest is None:
+        return rusty_v8_checksum_manifest_path(version)
+    if manifest.is_absolute():
+        return manifest
+    return ROOT / manifest
+
+
 def staged_archive_name(target: str, source_path: Path) -> str:
     if source_path.suffix == ".lib":
         return f"rusty_v8_release_{target}.lib.gz"
@@ -244,8 +271,18 @@ def stage_release_pair(
 
     shutil.copyfile(binding_path, staged_binding)
 
+    staged_checksums = output_dir / f"rusty_v8_release_{target}.sha256"
+    with staged_checksums.open("w", encoding="utf-8") as checksums:
+        for path in [staged_library, staged_binding]:
+            digest = hashlib.sha256()
+            with path.open("rb") as artifact:
+                for chunk in iter(lambda: artifact.read(1024 * 1024), b""):
+                    digest.update(chunk)
+            checksums.write(f"{digest.hexdigest()}  {path.name}\n")
+
     print(staged_library)
     print(staged_binding)
+    print(staged_checksums)
 
 
 def parse_args() -> argparse.Namespace:
@@ -264,6 +301,24 @@ def parse_args() -> argparse.Namespace:
 
     subparsers.add_parser("resolved-v8-crate-version")
 
+    check_module_bazel_parser = subparsers.add_parser("check-module-bazel")
+    check_module_bazel_parser.add_argument("--version")
+    check_module_bazel_parser.add_argument("--manifest", type=Path)
+    check_module_bazel_parser.add_argument(
+        "--module-bazel",
+        type=Path,
+        default=MODULE_BAZEL,
+    )
+
+    update_module_bazel_parser = subparsers.add_parser("update-module-bazel")
+    update_module_bazel_parser.add_argument("--version")
+    update_module_bazel_parser.add_argument("--manifest", type=Path)
+    update_module_bazel_parser.add_argument(
+        "--module-bazel",
+        type=Path,
+        default=MODULE_BAZEL,
+    )
+
     return parser.parse_args()
 
 
@@ -280,6 +335,22 @@ def main() -> int:
     if args.command == "resolved-v8-crate-version":
         print(resolved_v8_crate_version())
         return 0
+    if args.command == "check-module-bazel":
+        version = command_version(args.version)
+        manifest_path = command_manifest_path(args.manifest, version)
+        try:
+            check_module_bazel(args.module_bazel, manifest_path, version)
+        except RustyV8ChecksumError as exc:
+            raise SystemExit(str(exc)) from exc
+        return 0
+    if args.command == "update-module-bazel":
+        version = command_version(args.version)
+        manifest_path = command_manifest_path(args.manifest, version)
+        try:
+            update_module_bazel(args.module_bazel, manifest_path, version)
+        except RustyV8ChecksumError as exc:
+            raise SystemExit(str(exc)) from exc
+        return 0
     raise SystemExit(f"unsupported command: {args.command}")