[Repo Assist] ci: pin actions/github-script to SHA (upgrade @v7 → @v8)

[github-actions]

🤖 This PR was created by Repo Assist, an automated AI assistant.

Summary

All other GitHub Actions in ci.yml are already pinned to immutable commit SHAs — but the four actions/github-script usages still reference the mutable tag @v7, which can be silently updated by the action author.

This PR pins all four uses to ed597411d8f924073f98dfc5c65a23a2325f34cd (v8), the same SHA used in every other workflow in this repository (agentics-maintenance.yml, rust-guard-improver.lock.yml, etc.).

Changes

• .github/workflows/ci.yml: replace actions/github-script@v7 with actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8 in four places (smoke-copilot-pr, smoke-copilot, large-payload-tester, language-support-tester jobs).

Rationale

• Security: Pinning to a commit SHA means the action cannot be silently replaced with malicious code by moving a tag. This is the standard supply-chain hardening practice.
• Consistency: Every other action in this file is already SHA-pinned. This brings github-script in line with the existing pattern.
• Version upgrade: Also bumps from v7 → v8 (the version the rest of the repo already uses), picking up any improvements in that major release.

Test Status

This is a CI workflow file change only — no Go code is modified. The change is purely mechanical (tag → SHA). The same SHA (ed597411d8f924073f98dfc5c65a23a2325f34cd) has been running successfully in multiple other workflows in this repo.

Generated by Repo Assist · ◷

To install this agentic workflow, run

gh aw add githubnext/agentics/workflows/repo-assist.md@851905c06e905bf362a9f6cc54f912e3df747d55

Warning

⚠️ Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• proxy.golang.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "proxy.golang.org"

See Network Configuration for more information.