Pin the remaining Cutter upload/download actions and enforce immutable GitHub/Docker references at actual action call sites. Run the same exact guard for workflow-only changes without preparing runtime artifacts.
Co-authored-by: Govindu Sasanka <[email protected]>
Co-authored-by: Kaoru0822 <[email protected]>