fix(ci): pin actions to versions the runner can execute

The floating tags moved to node24; act_runner 0.2.6 — the version that matches
Gitea 1.20 — supports node20 at most, so every job died before running a single
test. Pinned to the newest releases that still declare node20.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitea/workflows/tests.yml

@@ -14,10 +14,13 @@ jobs:
   pest:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v4.2.2
 
       - name: Set up PHP
-        uses: shivammathur/setup-php@v2
+        # Pinned: the floating v2 tag now requires node24, which the runner
+        # matching Gitea 1.20 cannot execute. 2.34.1 is the newest that still
+        # declares node20.
+        uses: shivammathur/setup-php@2.34.1
         with:
           php-version: '8.4'
           extensions: mbstring, pdo_sqlite, sodium, redis, bcmath, gd, zip
@@ -38,9 +41,9 @@ jobs:
   assets:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v4.2.2
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v4.1.0
         with:
           node-version: '22'
 
@@ -58,7 +61,7 @@ jobs:
     if: github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v4.2.2
         with:
           fetch-depth: 0