contracts-docs.yml: pin keep-network/ci reusable workflow off floating @main ref

[piotr-roslaniec]

.github/workflows/contracts-docs.yml calls a third-party reusable workflow pinned to a mutable branch ref:

uses: keep-network/ci/.github/workflows/reusable-solidity-docs.yml@main

The calling job (contracts-docs-publish, gated to release events on version tags) hands this callee three secrets: THRESHOLD_DOCS_GITHUB_TOKEN, THRESHOLD_DOCS_GPG_PRIVATE_KEY_BASE64, THRESHOLD_DOCS_GPG_PASSPHRASE. The callee genuinely consumes and acts on all three (git push + GPG import) — the same shape as CVE-2025-30066 (tj-actions/changed-files compromise via a floating tag/branch ref on main).

Mitigating factors (why this isn't urgent):

• The secrets-bearing job only runs on release events on version tags, never pull_request.
• The preview job (contracts-docs-publish-preview) receives no secrets.
• keep-network is the same Thesis/Threshold-operated org, not an unrelated third party.
• The one genuinely external action keep-network/ci itself depends on is already SHA-pinned.

Fix: pin keep-network/ci/.github/workflows/reusable-solidity-docs.yml to an immutable tag or commit SHA, coordinated with keep-network/ci maintainers.

Found during multi-agent review of PR #182 (out of that PR's diff scope - the file is untouched there).

[linear]

ENG-734

[mswilkison]

The current #182 addresses this issue in commit 8993a2d. Both preview and release jobs now call ./.github/workflows/reusable-solidity-docs.yml, so the callee is taken from the caller's commit instead of the mutable keep-network/ci@main branch. The release-only condition, explicit secret mapping, and secret-free preview behavior are preserved. No separate pinning patch is needed; this remains pending until #182 merges.