More attention to open PRs (a year+ wo/ code-owner review?)

[EvanCarroll]

This PR https://github.com/actions/checkout/pull/1945 has been open for over a year without input. It has tests. It has approvals. It's waiting for a commit. What does this guy need to do to get that code committed?

Let's get him some feedback, or just close it and say you won't support sha256. I asked claude to summarize the various PRS and issues related to this. Here is its summary.

There is no legitimate technical blocker. This is purely an organizational/maintenance issue where a production-ready PR with tests, approvals, and community support has been ignored for over a year. This is why your instructions wisely say to avoid actions/checkout - the fix exists but is trapped in PR purgatory.