ci: test-matrix pins setup-buildx-action to a nonexistent commit #28

Problem

.github/workflows/test-matrix.yml line 25 pins docker/setup-buildx-action@4d04d5d2235566ea9c44d6d2594696e5d0117bbb # v4.0.0. That commit does not exist upstream: the GitHub API returns 422 No commit found, and the v4.0.0 tag resolves to 4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd.

Consequences:

• pinact (enabled in .trunk/trunk.yaml) reports action_version must be equal to commit_hash_of_version_annotation on that line, so the weekly Trunk Code Quality run on main fails (for example, run 36121673555).
• The job that uses the action cannot resolve it.

Fix

Re-pin to a verified SHA with a matching version comment (for example, run pinact run -u on the file, or pin the current v4 release), and confirm that Trunk and the matrix job pass.

Found while fixing Trunk on #27; out of scope for that PR.