chore: pin actions and drop persisted checkout credentials; raise coverage

[shenxianpeng]

Summary

This PR has three kinds of change:

1. SHA pinning. The osv-scanner reusable workflows were the only actions still referenced by tag. They are now pinned to the commit of the same tag (v2.6.0), with the tag in a trailing comment. labeler.yml still calls the org workflow at @main.

2. No persisted credentials. persist-credentials: false is set on the 9 actions/checkout steps of jobs that never push. The docs deploy job keeps the default, because mkdocs gh-deploy pushes with those credentials.

3. Coverage.

   • 126 new tests across 22 test files, two of them new (utils/cache_tests.py, utils/rendering_tests.py).
   • lunr is added to the hatch test environment, so prebuild_index: python is tested against the real library.
   • Narrow # pragma: no cover comments mark lines that can't run in the test suite:
     • the docs-only BasePlugin handler stubs, which are deleted at import;
     • the Windows-only colorama setup;
     • the import fallbacks for Markdown < 3.4, Jinja2 < 3.0 and a missing lunr;
     • an unreachable except in get_files().

   Apart from these comments, the source code is unchanged.

Coverage

Line coverage, measured with hatch run test:with-coverage (coverage.py, --source=mkdocs --omit "mkdocs/tests/*", Python 3.14):

	Tests	Statements	Missed	Line coverage
Base (main)	780	3865	277	93%
This PR	906	3837	2	99.95%

The two uncovered lines are mkdocs/config/config_options.py 529-530.

Verification

• hatch run +py=3.14 test:with-coverage and hatch run +py=3.10 test:test pass, in both the default and min-req variants.
• pre-commit run --all-files passes.
• actionlint reports no problems.
• The pinned SHA matches refs/tags/v2.6.0 (git ls-remote).

Checklist

• New tests added for new behavior (if applicable)
• Documentation updated (if applicable)
• Release notes docs/about/release-notes.md updated (if applicable)

[codspeed]

Merging this PR will not alter performance

✅ 28 untouched benchmarks

---

_{Comparing chore/repo-health-check (0873b8a) with main (0e745b4)}