* CI: run the gate through craft-common-actions' shared gate.yml; FreeBSD nightly and on release
ci.yml calls the shared workflow (cached apt packages, nextest, main-only cache saves, Cargo.lock check). FreeBSD runs nightly and on pushes to release instead of on pull requests. Depends on storytold/craft-common-actions#69.
* CI: build the shared gate without craft-fonts, as before
* CI: build the shared gate with release.yml's craft-fonts pin
Pin third-party actions to full-length commit SHAs (with version comments)
instead of mutable tags/branches to prevent supply-chain tampering via
retagged releases. Resolves SonarCloud rule githubactions:S7637.
aiongg