ci(release): pin free-disk-space action + stop removing LLVM

Review feedback on the Linux release workflow:

1. `jlumbroso/free-disk-space@main` was an unpinned ref in a job that
   runs with `contents: write` and handles signing secrets. Pin to the
   v1.3.1 commit SHA so a force-push or repo compromise can't inject
   arbitrary code into our release flow.

2. `large-packages: true` runs `apt-get remove '^llvm-.*'`, wiping LLVM
   just before the next step installs `llvm-dev`. That wastes CI time
   and risks cascade-removal of reverse deps that won't be pulled back
   in by `llvm-dev` alone. The remaining toggles (android, dotnet,
   haskell, swap-storage) already clear ~20 GB, which is enough
   headroom for the Python + torch + PyInstaller build.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

.github/workflows/release.yml

@@ -50,13 +50,19 @@ jobs:
       # "github runners suck") — not a code issue, a disk-pressure one.
       - name: Free up disk space (ubuntu)
         if: contains(matrix.platform, 'ubuntu') || contains(matrix.platform, 'namespace')
-        uses: jlumbroso/free-disk-space@main
+        # Pinned to v1.3.1 (SHA) — this job runs with contents: write and
+        # handles signing secrets later, so we don't want a floating ref.
+        uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be
         with:
           tool-cache: false
           android: true
           dotnet: true
           haskell: true
-          large-packages: true
+          # large-packages: true would `apt-get remove '^llvm-.*'`, which
+          # cascade-removes reverse deps that won't be pulled back in by the
+          # `llvm-dev` install below. The other flags already free ~20 GB,
+          # enough for the Python + torch + PyInstaller build.
+          large-packages: false
           swap-storage: true
 
       - name: Install dependencies (ubuntu only)