bug: third-party Actions pinned to mutable refs in `bench.yml`

[minagishl]

Bug Description

.github/workflows/bench.yml uses several third-party Actions pinned to mutable refs:

• pnpm/action-setup@v4
• actions/setup-node@v4 (first-party — OK with @v4 per convention, but SHA-pinning is still safer)
• dtolnay/rust-toolchain@stable — branch ref, force-pushable

No secrets are in scope for bench.yml (it does not publish), so the immediate blast radius is execution as the runner user with default GITHUB_TOKEN. Still a supply-chain hygiene gap.

Steps to Reproduce

1. grep -E "uses:" .github/workflows/bench.yml.
2. Observe mutable refs.

Expected Behavior

SHA-pin every third-party action:

uses: dtolnay/rust-toolchain@<sha> # stable
uses: pnpm/action-setup@<sha> # v4

Actual Behavior

Mutable refs.

Environment

• Repo: recurram-bench
• File: .github/workflows/bench.yml

Additional Context

Severity: Low.