* test: stabilize suite and add coverage heatmap * ci: run full bun test suite in pr checks
Pin all GitHub Actions to commit SHA instead of mutable version tags to prevent supply chain attacks via tag poisoning. This is especially important for third-party actions like oven-sh/setup-bun.
