feat: componentize GStack 2 runtime and release integrity

.github/workflows/version-gate.yml

@@ -1,5 +1,8 @@
 name: Version Gate
 
+permissions:
+  contents: read
+
 on:
   pull_request:
     paths:
@@ -20,13 +23,13 @@ jobs:
       pull-requests: read
     steps:
       - name: Checkout PR head
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           fetch-depth: 0
           ref: ${{ github.event.pull_request.head.sha }}
 
       - name: Setup Bun
-        uses: oven-sh/setup-bun@v2
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
 
       - name: Read versions
         id: versions