chore(ci): pin release-please and sync vouch SHA references

Pin release-please-action to the v4.4.0 commit SHA for reproducibility. Sync README and structure validation script with the currently pinned vouch action SHA.

Validation: npm run check

Author: lightningRalf

.github/workflows/release-please.yml

@@ -19,7 +19,7 @@ jobs:
       issues: write
     steps:
       - name: Run release-please
-        uses: googleapis/release-please-action@v4
+        uses: googleapis/release-please-action@16a9c90856f42705d54a6fda1823352bdc62cf38 # v4.4.0
         with:
           config-file: .release-please-config.json
           manifest-file: .release-please-manifest.json

README.md

@@ -158,7 +158,7 @@ Default behavior:
 - PR workflow runs on `pull_request_target` (`opened`, `reopened`).
 - `require-vouch: true` and `auto-close: true` are enabled by default.
 - Maintainers can comment `vouch`, `denounce`, or `unvouch` on issues to update trust state.
-- Vouch actions are SHA pinned (`5713ce1baedf75e2f830afa3dac813a9c48bff12`) for reproducibility and supply-chain review.
+- Vouch actions are SHA pinned (`0e11a71bba23218a284d3ecca162e75a110fd7e3`) for reproducibility and supply-chain review.
 
 Bootstrap step:
 

scripts/validate-structure.sh

@@ -128,7 +128,7 @@ if [[ -n "$placeholder_hits" ]]; then
   ((errors+=1))
 fi
 
-vouch_ref="5713ce1baedf75e2f830afa3dac813a9c48bff12"
+vouch_ref="0e11a71bba23218a284d3ecca162e75a110fd7e3"
 if ! grep -q "mitchellh/vouch/action/check-pr@${vouch_ref}" ".github/workflows/vouch-check-pr.yml"; then
   echo "vouch-check-pr workflow must pin mitchellh/vouch/action/check-pr to ${vouch_ref}" >&2
   ((errors+=1))