ci: pin the bridge action to the merged main commit

voidzero-dev/pkg-pr-registry-bridge#86 is merged and deployed, so both pins
move from that PR's branch head to the resulting main commit and the TODO
comments go away.

Worth noting the old pin was stale even against the branch: fd9ad0e predated
the simplify pass and the second review round, so it would have run the
action without the SR-6 hardening (tar size-field agreement, artifact size
and count bounds, the long-path refusal).

Verified action.yml and the bundled dist resolve at the new SHA.

Author: fengmk2

.github/workflows/publish-preview-register.yml

@@ -135,9 +135,7 @@ jobs:
       # minted here; no admin-token, so no bridge secret lives in this repo.
       - name: Publish to the registry bridge
         id: bridge
-        # TODO: repoint to a main SHA once voidzero-dev/pkg-pr-registry-bridge#86
-        # merges. Pinned to that PR's head so this can be tested end to end first.
-        uses: voidzero-dev/pkg-pr-registry-bridge@fd9ad0e5878ecbd6fd525bc01ac706838795ee90 # oidc branch
+        uses: voidzero-dev/pkg-pr-registry-bridge@4ca2c31c250c7137ae191bf01a8bb106d30aa106 # main
         with:
           mode: upload
           # Trusted: GitHub signs this into the event payload. The published

.github/workflows/publish-preview.yml

@@ -155,9 +155,7 @@ jobs:
       # same-repo gate here existed only because fork runs cannot read the
       # admin token secret.
       - name: Pack packages for the registry bridge
-        # TODO: repoint to a main SHA once voidzero-dev/pkg-pr-registry-bridge#86
-        # merges. Pinned to that PR's head so this can be tested end to end first.
-        uses: voidzero-dev/pkg-pr-registry-bridge@fd9ad0e5878ecbd6fd525bc01ac706838795ee90 # oidc branch
+        uses: voidzero-dev/pkg-pr-registry-bridge@4ca2c31c250c7137ae191bf01a8bb106d30aa106 # main
         with:
           mode: pack
           # The PR head commit, not the merge commit github.sha. Advisory here;