test(generate): relax frozen action-pins snapshot to structural invariants

[joshua-temple]

Problem

TestDefaultActionPins_MatchesPriorHardcodedTable hardcoded the exact tag/sha/version of every emit:true governed action and asserted defaultActionPins matched value-for-value. That was a one-time migration-safety check for when the hardcoded table became the embedded action_pins.yaml manifest. Since the manifest is now the single source of truth and legitimately changes over time (Dependabot bumps, and the new self-heal reconcile companion adopting a pin), the frozen assertion fails on every legitimate governed-pin change, including the reconcile companion's own commits.

Fix

Renamed the test to TestDefaultActionPins_OnlyEmitTrueEntriesWellFormed and relaxed it to check structural invariants derived from the manifest itself instead of hardcoded values:

• defaultActionPins contains exactly the manifest's emit:true actions (no emit:false leak, none missing).
• Every entry has a non-empty tag, a non-empty version, and a sha matching the existing 40-char lowercase hex commitSHAPattern.

Dropped the hardcoded per-value comparison.

Verification

• go build ./..., go test ./..., and golangci-lint run ./... all clean.
• Confirmed the relaxed test still passes after simulating a legitimate pin bump (changed actions/create-github-app-token's tag/sha/version in action_pins.yaml).
• Confirmed it correctly fails when an emit:false action leaks into the parsed table, and when a governed action's sha is malformed (both verified via temporary local fault injection, reverted before commit).