CI: pin apple-actions/import-codesign-certs to a commit SHA (CodeQL gate red on main) #11

What

Evidence: gh run list --branch main --workflow codeql.yml shows this CodeQL gate failing on main for 5 consecutive weekly scheduled runs since 2026-07-06, at commit bb6df11 (introduced by "feat(auth): complete OAuth flow + UX polish"). Confirmed via git diff origin/main...feat/mobile-linear-client -- .github/workflows/testflight.yml (empty diff) that no in-flight mobile PR touches this file — the finding is purely pre-existing and unrelated to any open PR's own changes.

Why (motivation)

CodeQL flags the actions/unpinned-tag rule as a gated warning-level finding on the apple-actions/import-codesign-certs action pinned at tag v3 in .github/workflows/testflight.yml. GATE_LEVELS=error warning means any warning-level finding fails the gate.

User impact

Every PR's check list shows a red CodeQL Self-Gate (actions) check, because CodeQL re-scans the whole repo state, not just the diff — this blocks merging via gh ship for ALL PRs, not just ones that touch this file, including the currently-open mobile PR #10.

Cost of inaction

No PR can be self-merged via gh ship while this gate is red; every PR needs a manual --admin override or the gate needs disabling, both worse than just pinning the SHA.

Acceptance criteria

• CodeQL Self-Gate (actions) check passes on main and on all PRs
• .github/workflows/testflight.yml references a pinned commit SHA instead of the 'v3' tag

Screenshots

(none)

Links

• (none)

Skipped gates

• links: the only bare-looking reference is the action name repeated inside markdown link text that already points to https://github.com/apple-actions/import-codesign-certs