fix: apply SHA pinning to on.steps in pre-activation job

pkg/workflow/compiler_orchestrator_workflow.go

@@ -865,6 +865,24 @@ func (c *Compiler) processOnSectionAndFilters(
 	if err != nil {
 		return err
 	}
+
+	// Apply action pinning to on.steps
+	if len(onSteps) > 0 {
+		anySteps := make([]any, len(onSteps))
+		for i, s := range onSteps {
+			anySteps[i] = s
+		}
+		typedSteps, convErr := SliceToSteps(anySteps)
+		if convErr == nil {
+			typedSteps = ApplyActionPinsToTypedSteps(typedSteps, workflowData)
+			for i, s := range typedSteps {
+				onSteps[i] = s.ToMap()
+			}
+		} else {
+			orchestratorWorkflowLog.Printf("Failed to convert on.steps to typed steps for action pinning: %v", convErr)
+		}
+	}
+
 	workflowData.OnSteps = onSteps
 
 	// Extract on.permissions for pre-activation job permissions