The actions actions/checkout@v4, actions/setup-node@v4, and oven-sh/setup-bun@v2 are not allowed in braintrustdata/braintrust-opencode-plugin because all actions must be pinned to a full-length commit SHA.