fix(release): align package metadata and workflow action pins

Ensure release automation updates pyproject metadata to prevent duplicate-version PyPI publishes, and pin workflow actions to current immutable SHAs for consistency and security.

Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>