ci: pin to shas tools fetched via tags (#2761)