Driver

Follow-up from /gstack-cso daily audit (2026-06-06).

Scope

1. Pin third-party and first-party GitHub Actions to immutable commit SHAs in .github/workflows/.
2. Remove unused animejs npm dependency from blendavit static site (not loaded in shipped HTML).

Acceptance criteria

• All workflow uses: references use full SHAs with version comments
• projects/smartmomlabs/website/package.json removed (zero runtime npm deps)
• node_modules/ gitignored under blendavit website