chore(ci): pin central workflow refs to v1.0.0

The four refs pointed at fd60e4c9 with a '# main' comment. That comment
names a branch, so Dependabot rendered its bump PR titles as two full
40-character SHAs. Sea-Haven-Industries/.github now publishes tags.

Repoints all four at 2fbfb2e (v1.0.0) and replaces the comment with the
version. Deliberately v1.0.0 rather than the current v1.0.2, so a
Dependabot run has a newer version to find.

.github/workflows/ci.yaml

@@ -8,7 +8,7 @@ permissions:
 
 jobs:
   ci:
-    uses: Sea-Haven-Industries/.github/.github/workflows/ci-typescript-cdk.yaml@fd60e4c9041784f666ac0fdefb9bec3c7fbf5143 # main
+    uses: Sea-Haven-Industries/.github/.github/workflows/ci-typescript-cdk.yaml@2fbfb2e7cf506ce27edb653e0981fd9bdd5622c9 # v1.0.0
     with:
       run-typecheck: false
       run-cdk-synth: false

.github/workflows/dependency-review.yml

@@ -7,4 +7,4 @@ permissions:
 
 jobs:
   review:
-    uses: Sea-Haven-Industries/.github/.github/workflows/callable-dependency-review.yaml@fd60e4c9041784f666ac0fdefb9bec3c7fbf5143 # main
+    uses: Sea-Haven-Industries/.github/.github/workflows/callable-dependency-review.yaml@2fbfb2e7cf506ce27edb653e0981fd9bdd5622c9 # v1.0.0

.github/workflows/deploy.yaml

@@ -13,7 +13,7 @@ concurrency:
 
 jobs:
   deploy:
-    uses: Sea-Haven-Industries/.github/.github/workflows/cd-sam.yaml@fd60e4c9041784f666ac0fdefb9bec3c7fbf5143 # main
+    uses: Sea-Haven-Industries/.github/.github/workflows/cd-sam.yaml@2fbfb2e7cf506ce27edb653e0981fd9bdd5622c9 # v1.0.0
     with:
       stack-name: payments-dashboard
       cfn-role-arn: arn:aws:iam::328440206208:role/github-cfn-execution-role

.github/workflows/labeler.yml

@@ -8,4 +8,4 @@ permissions:
   issues: write
 jobs:
   label:
-    uses: Sea-Haven-Industries/.github/.github/workflows/callable-labeler.yaml@fd60e4c9041784f666ac0fdefb9bec3c7fbf5143 # main
+    uses: Sea-Haven-Industries/.github/.github/workflows/callable-labeler.yaml@2fbfb2e7cf506ce27edb653e0981fd9bdd5622c9 # v1.0.0