ci: call the shared workflow by tag instead of @main (#29)

The workflow was pointing at GSTJ/magic@main, so any merge over there
reran this repo's CI with whatever had just landed. `@v1` is the moving
major tag: fixes still arrive on the next run, but only after a release.

ci.yml and the setup composite are identical at v1 and main right now, so
this is a no-op for the current run. The four inputs passed here
(build-command, test-command, extra-command, turbo-cache) all exist in
v1's workflow_call signature with the same types.

The magic-* devDependencies are already on the current latest (1.2.0,
magic-codemods 1.1.0), so nothing to bump. magic-oxlint-plugin stays out
— this repo enables none of its rules.

Claude-Session: https://claude.ai/code/session_01Fe92vvdc4R3F4BDBFoLcw1

Author: GSTJ

.github/workflows/ci.yml

@@ -16,7 +16,11 @@ jobs:
   checks:
     # Install, lint, format and typecheck are the shared workflow's; node comes
     # from .nvmrc and pnpm from the `packageManager` field.
-    uses: GSTJ/magic/.github/workflows/ci.yml@main
+    #
+    # `@v1` is the moving major tag, so a fix in the shared workflow lands here
+    # on the next run. Never `@main`: an unreviewed merge there would rerun
+    # every consumer's CI.
+    uses: GSTJ/magic/.github/workflows/ci.yml@v1
     with:
       build-command: pnpm run build
       test-command: pnpm run test