ci(canary): pin actions and scope the sunset workflow token

CodeQL flagged both on the new workflow: an unscoped GITHUB_TOKEN and an
unpinned third-party action. Matches the pins ci.yml already uses.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.github/workflows/canary-sunset.yml

@@ -7,6 +7,9 @@
 # the guard.
 name: Canary sunset
 
+permissions:
+  contents: read
+
 on:
   schedule:
     # Mondays at 15:10 UTC, shortly after the CodeQL run.
@@ -17,8 +20,8 @@ jobs:
   sunset:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: oven-sh/setup-bun@v2
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
           bun-version: latest
       # No install/build: the script imports the registry source directly and