Harden CI workflow and drop SHA-1 for episode ids

Pin actions to commit SHAs, restrict the token to read-only contents,
and don't persist checkout credentials. Use SHA-256 for episode ids.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01YbuVfbQEpaitM5TMjBMzkF

.github/workflows/tests.yml

@@ -1,5 +1,7 @@
 name: tests
 on: [push, pull_request]
+permissions:
+  contents: read
 jobs:
   test:
     runs-on: ubuntu-latest
@@ -7,8 +9,10 @@ jobs:
       matrix:
         python-version: ["3.10", "3.13"]
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: ${{ matrix.python-version }}
       - run: pip install -e ".[dev]"

museengine/memory.py

@@ -79,7 +79,7 @@ class MemoryStore:
 
     def add_episode(self, problem: str, summary: str, is_open: bool = True) -> Episode:
         now = time.time()
-        ep_id = "ep_" + hashlib.sha1(f"{problem}\0{now}".encode()).hexdigest()[:10]
+        ep_id = "ep_" + hashlib.sha256(f"{problem}\0{now}".encode()).hexdigest()[:10]
         with self.conn:
             self.conn.execute(
                 "INSERT INTO episodes (id, problem, summary, is_open, created_at) VALUES (?, ?, ?, ?, ?)",