[cpp-RCP-15] ilammy/msvc-dev-cmd and the RELAY conformance checkout are unpinned in CI #83

Location: .github/workflows/ci.yml:60 (ilammy/msvc-dev-cmd@v1) and :96-100 (RELAY conformance checkout).

Finding: Two CI dependency-pinning gaps, scoped separately from the already-tracked cpp-FuSa unpinned-clone issue (#59), which covers the identical problem for cpp-FuSa in both ci.yml and release.yml:

1. ilammy/msvc-dev-cmd@v1 pins to a mutable major-version tag rather than a commit SHA, so the action's actual code can change under this workflow without any corresponding change in this repo.
2. The "Checkout RELAY (authoritative conformance validator)" step (actions/checkout@v4 with repository: SoundMatt/RELAY) has no ref: pin, so it always checks out RELAY's default branch at whatever state it happens to be in when CI runs — meaning the "authoritative conformance validator" gate's actual behavior can shift over time independent of any change to this repository.

Recommendation: Pin ilammy/msvc-dev-cmd to a specific commit SHA rather than the v1 tag, and add an explicit ref: (a tagged RELAY release or pinned SHA) to the RELAY conformance checkout so the conformance gate's behavior is reproducible and only changes when this repo deliberately bumps the pin.

Verification: Independently re-read .github/workflows/ci.yml against current HEAD (commit 4b9449a, 2026-07-29). Confirmed ilammy/msvc-dev-cmd@v1 is still an unpinned tag reference, and the RELAY checkout step has no ref: key. This issue intentionally excludes the cpp-FuSa unpinned-clone portion of the original audit finding, since that's already filed and more thoroughly documented as issue #59.

Filed from the 2026-07-29 ecosystem audit register; independently re-verified against current HEAD before filing.