ci: address review on checksum workflow — pin checkout, guard empty glob, quiet output (DEVA11Y-475)

Resolves the three review comments on the verify-selfupdate-checksums workflow:

- F-3: pin actions/checkout to a full SHA (v4.2.2) to match the repo's Semgrep.yml convention and close the action-injection surface.

- F-2: guard against an empty scripts/**/*.sh glob (would otherwise pass silently); error and exit 1 if no scripts are found.

- F-1: redirect sha256sum -c stdout to /dev/null and emit a ::notice:: on success, so GitHub annotations are the sole pass/fail channel.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: Crash0v3rrid3

.github/workflows/verify-selfupdate-checksums.yml

@@ -24,7 +24,7 @@ jobs:
   verify-sidecars:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Verify scripts and .sha256 sidecars are in sync
         run: |
@@ -33,7 +33,12 @@ jobs:
           status=0
 
           # 1. Every self-updating script must have a sidecar.
-          for script in scripts/**/*.sh; do
+          script_files=(scripts/**/*.sh)
+          if [ ${#script_files[@]} -eq 0 ]; then
+            echo "::error::No .sh scripts found under scripts/ — checkout or glob is wrong."
+            exit 1
+          fi
+          for script in "${script_files[@]}"; do
             if [ ! -f "${script}.sha256" ]; then
               echo "::error file=${script}::Missing checksum sidecar ${script}.sha256. Generate it from the script's directory: shasum -a 256 <name>.sh | awk '{print \$1\"  <name>.sh\"}' > <name>.sh.sha256"
               status=1
@@ -55,8 +60,8 @@ jobs:
               continue
             fi
             # Sidecars store "<sha256>  <basename>", so verify from the script's dir.
-            if ( cd "$dir" && sha256sum -c "$(basename "$sidecar")" ); then
-              echo "OK: $sidecar"
+            if ( cd "$dir" && sha256sum -c "$(basename "$sidecar")" > /dev/null ); then
+              echo "::notice file=${script}::Checksum OK"
             else
               echo "::error file=${script}::Checksum mismatch — regenerate ${sidecar} after editing ${script} (run from ${dir}): shasum -a 256 <name>.sh | awk '{print \$1\"  <name>.sh\"}' > <name>.sh.sha256"
               status=1