Hide registry credentials from SSH argv and pin publishing actions

Use a mode-0600 RemoteCommand file with percent escaping for sensitive management commands.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

.github/workflows/exe-dev-image.yml

@@ -29,7 +29,7 @@ jobs:
       - run: pnpm install --frozen-lockfile
       - name: Build and publish immutable experimental image
         run: node cli/node_modules/tsx/dist/cli.mjs scripts/build-exe-dev-image.ts --push --metadata-file /tmp/exe-image.json
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: exe-dev-image-digest
           path: /tmp/exe-image.json