ci: enforce workflow policy

[albert20260301]

Summary

• move Linux workflow jobs to ubuntu-24.04
• pin every third-party action to its reviewed commit SHA
• replace the duplicate legacy semantic workflow with the managed canonical workflow

Impact

This is CI-only. It preserves the existing Python version matrix, test commands, release configuration, and PyPI trusted-publishing permissions.

Validation

• bash /root/.openclaw/workspace/scripts/validate-workflow-policy.sh /root/.openclaw/workspace/code/altertable-python-workflow-policy-20260809
• canonical semantic-workflow comparison
• git diff --check
• local poetry run pytest was unavailable because Poetry is not installed in this maintenance environment; repository CI is required before merge.

[albert20260301]

@fvaleye could you review this?

I picked you because the product Python repository's existing community-sync work has your approval and Python is in your ownership area. CI is pending. The main review focus is that the runner and immutable-action updates preserve the existing Python matrix and trusted-publishing flow.