Hardened the branch/PR workflow and pinned stack versions.