chore(ci): pin central workflow refs to v1.0.0

The three refs pointed at fd60e4c9 with a trailing '# main' comment. That
comment names a branch, not a version, and Sea-Haven-Industries/.github had
no tags, so Dependabot's github-actions updater had nothing to resolve a
newer SHA against.

That repo now tags releases. Repoints all three at 2fbfb2e (v1.0.0) and
replaces the comment with the version.

.github/workflows/ci.yaml

@@ -4,7 +4,7 @@ on:
     branches: [main]
 jobs:
   ci:
-    uses: Sea-Haven-Industries/.github/.github/workflows/ci-python-app.yaml@fd60e4c9041784f666ac0fdefb9bec3c7fbf5143 # main
+    uses: Sea-Haven-Industries/.github/.github/workflows/ci-python-app.yaml@2fbfb2e7cf506ce27edb653e0981fd9bdd5622c9 # v1.0.0
     with:
       python-version: "3.12"
       # Lint app + tests so test code is held to the same ruff bar.

.github/workflows/dependency-review.yml

@@ -3,4 +3,4 @@ on:
   pull_request:
 jobs:
   review:
-    uses: Sea-Haven-Industries/.github/.github/workflows/callable-dependency-review.yaml@fd60e4c9041784f666ac0fdefb9bec3c7fbf5143 # main
+    uses: Sea-Haven-Industries/.github/.github/workflows/callable-dependency-review.yaml@2fbfb2e7cf506ce27edb653e0981fd9bdd5622c9 # v1.0.0

.github/workflows/labeler.yaml

@@ -8,4 +8,4 @@ permissions:
   issues: write            # required — creates labels that don't exist yet
 jobs:
   labeler:
-    uses: Sea-Haven-Industries/.github/.github/workflows/callable-labeler.yaml@fd60e4c9041784f666ac0fdefb9bec3c7fbf5143 # main
+    uses: Sea-Haven-Industries/.github/.github/workflows/callable-labeler.yaml@2fbfb2e7cf506ce27edb653e0981fd9bdd5622c9 # v1.0.0