[goastler]

What changed:

• The pnpm/action-setup + actions/setup-node + pnpm install steps copied into 14 jobs are now one setup-pnpm step from prosopo/github_actions (pinned to a7252e6). The jobs still cache the pnpm store through setup-node, with the same lockfiles in the key.
• The GitHub App token step uses the shared app-token action.
• Every action is pinned to a full commit SHA with a version comment; actions/checkout is bumped to v7.0.1 (its only breaking change blocks fork checkouts under pull_request_target/workflow_run, which no workflow here does).

Effect: same node and pnpm versions and the same cache as before, but set in one place shared with the other prosopo repos. setup-node moves to v7.1.0.

Not changed: Swatinem/rust-cache in cargo-test.yml (per-crate workspaces keyed on the rustc version, which the shared cargo cache does not do), cache.yml's run-id keyed cache save, Docker and Android steps.

Tests: actionlint passes; the workflows run in this PR's CI.