While a release pull request is open, every commit to dev restarted the full test suite and cancelled the run that was in progress, so runs rarely finished and they kept taking runners from the builds here. The suite is now started by hand from the tests repo against the commit we want checked. A run started there is not cancelled by new commits, so it finishes, and nothing starts a new one on every commit.
Our workflows refer to actions by tag, and a tag can be moved to different code after we reviewed it. This adds GitHub's workflow lockfile, which records the exact commit behind each action version, and the workflows now name exact releases (v5.1.0 instead of v5, for example) as the lockfile tool requires. Dependabot already tracks these actions. The regression workflow that follows the tests repo's main branch is not covered.