ci: pin the first-party Zig dependencies to commits

.github/actions/first-party-zig-deps/pins.envadded+26-0

Changes to .github/actions/first-party-zig-deps/pins.env

		@@ -0,0 +1,26 @@
	1	+# Commit pins for craft's first-party Zig dependencies.
	2	+#
	3	+# `build.zig.zon` reaches these by relative path, so there is no `.url` + hash
	4	+# for Zig's package manager to verify and nothing else records which revision a
	5	+# build used. Cloning the default branch instead — which is what this action did
	6	+# until now — means an unrelated push to another repository decides whether
	7	+# craft's CI is green. That is not hypothetical: zig-js sized a SIMD loop by
	8	+# `@sizeOf(@Vector(8, u8))`, which is 8 on aarch64 and 16 on x86_64, and every
	9	+# Linux job here failed to compile for three days over it while macOS stayed
	10	+# green.
	11	+#
	12	+# To bump one: put the new SHA here and let CI prove it. That is a reviewable
	13	+# commit that says which revision changed and why, which "whatever main happened
	14	+# to be at 13:32" never was.
	15	+#
	16	+# Local development is unaffected: developers build against their own sibling
	17	+# checkouts, and this file is read only by the CI action next to it.
	18	+
	19	+# fix(lexer): size the SIMD identifier scan by lane count, not byte size (#625)
	20	+zig_js=eba3f7cfb8b32d6d84099b10f0e063fa0e0c53c7
	21	+
	22	+# fix(parser): make class-set construction failure-atomic (#20)
	23	+zig_regex=cfb24da9f1dd9e759cefec7d6e1dfa094998e9d8
	24	+
	25	+# refactor(heap): compare the build mode by tag name, across the Zig rename
	26	+zig_gc=89b6652c81ba892119b7b9ce3b0d07fc78a009ff