chore: improved workflows

[gabrielmfern]

This pull request cleans up our workflows so that they can better, faster, more safely, and more consistently with what we also have in React Email:

• Removes the extra Node setup step we had which was unnecessary since we're already running in the Node container
• Remove the extra Doppler CLI step since we aren't actually using Doppler for anything
• Uses only Node 20 for consistency (we should upgrade to a more recent version soon)
• Use only pinned commit versions for all outside actions: https://github.com/resend/resend-node/security/code-scanning/165
• Use explicit permissions for all workflows
• Separate the code for checking pinned dependencies onto another file in .github/scripts

---

Summary by cubic

Cleaned up and hardened CI workflows for faster, safer, and more consistent runs aligned with React Email. Standardized on Node 20, pinned external actions, and added explicit permissions.

• Refactors
  • Removed setup-node and Doppler CLI steps; rely on Node container.
  • Pinned external actions (e.g., checkout, pnpm) to commit SHAs; added explicit permissions.
  • Moved the pinned-dependencies check into .github/scripts/check-pinned-dependencies.mjs and invoked it from the workflow.
  • Standardized tests to node:20 and run on pushes to main and canary.

[cubic-dev-ai]

2 issues found across 5 files

_{React with 👍 or 👎 to teach cubic. You can also tag @cubic-dev-ai to give feedback, ask questions, or re-run the review.}

[cubic-dev-ai]

2 issues found across 5 files

_{React with 👍 or 👎 to teach cubic. You can also tag @cubic-dev-ai to give feedback, ask questions, or re-run the review.}