upgrade-github-actions

The workflow YAML itself does not contain overt malicious logic, but it includes a major supply-chain execution risk by running a repository-local action (`./local-action`) with CI-level capabilities and by authenticating to Docker Hub. Additionally, it pulls a container by tag rather than a pinned digest and uses tag-based third-party actions. Inspect the implementation of `./local-action`, verify workflow permissions (including whether secrets are exposed to forks), and pin actions/images to immutable digests/commits to reduce risk.