ci: schedule nightly race and fuzz, pin actions, add release-check and docs drift

Assisted-by: GLM 5.3 Flash

.gitea/workflows/race.yml

@@ -1,14 +1,20 @@
-# Race, Go. Dispatched by hand, and run as part of the release gates.
+# Race, Go. Dispatched by hand, run nightly on a schedule, and run as part of
+# the release gates.
 #
 # The race detector roughly doubles both time and memory, which the shared runner box
 # cannot afford on every push. Locally it belongs to `just gates`, which runs it once per
-# task; here it is an explicit decision rather than a routine.
+# task; here it is an explicit decision rather than a routine. The schedule is the
+# nightly sweep: a failing race on development is known by morning without anyone
+# remembering to dispatch it.
 #
 # Every step is one command, so the step that fails is the gate that failed.
 name: Race
 
 on:
   workflow_dispatch:
+  schedule:
+    # Nightly at 03:00 UTC, the quietest hours of the shared box.
+    - cron: "0 3 * * *"
 
 env:
   # One core: parallelism buys no speed here and costs memory the box does not have.
@@ -20,9 +26,9 @@ jobs:
     runs-on: fedora
     timeout-minutes: 45
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
         with:
           go-version-file: go.mod
           cache: true