ci(security): SHA-pin slsa-framework/slsa-github-generator in pages-deploy.yml

[WilliamBerryiii]

Problem

The slsa-framework/slsa-github-generator reusable workflow in pages-deploy.yml (line ~782) is referenced by tag only:

uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.1.0

While #100 will replace this entirely with actions/attest@v4.1.0, the tag-only reference is a supply chain risk in the interim. Tag references are mutable — a compromised tag could inject malicious code into the attestation workflow.

Proposed Solution

SHA-pin the existing reference until #100 lands:

uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@bcb39c1a0aa1e68c09f445acae2ca1116e301104  # v2.1.0

Acceptance Criteria

• slsa-framework/slsa-github-generator@v2.1.0 SHA-pinned with version comment
• SHA verified against slsa-framework/slsa-github-generator v2.1.0 release tag
• No behavioral change — same workflow, immutable reference

Notes

This is an interim fix. Issue #100 will remove this reference entirely. If #100 is implemented first, this issue can be closed as superseded.

Dependencies

• Superseded by: [FEATURE] Replace SLSA attestation with enterprise-compliant actions/attest #100 (will remove this reference entirely)