ci: harden web share deployment

[shideneyu]

Summary

• pin every third-party Action by commit SHA and remove the source token fallback
• verify and build pull requests without deployment secrets
• pass the exact build artifact ID into a protected deployment job
• limit deployment to protected main through release-web-share

Validation

• npm run build
• source-to-binary WASM verification against the pinned RMUX commit
• actionlint .github/workflows/pages.yml

This PR does not change the committed WASM bytes.

[cloudflare-workers-and-pages]

Deploying rmux-web-share with    Cloudflare Pages

Latest commit:	b5fb48d
Status:	✅  Deploy successful!
Preview URL:	https://9aa75a5e.rmux-web-share.pages.dev
Branch Preview URL:	https://ci-harden-release-deployment.rmux-web-share.pages.dev

View logs