[ci] Upgrade Expression to 3.0.0-rc

[smn]

Summary

• Upgrade expression dependency from hex ~> 2.48.0 to the release/3-0-0 branch on GitHub (3.0.0-rc)
• Update FlowRunner and DynamicSelectOneResponse to use Expression directly instead of the removed Expression.V2.Compat module
• Pin all GitHub Actions in CI workflows (elixir.yml, releases.yml, cla.yml) to full-length commit SHAs to comply with org security policy

Changes

• mix.exs / mix.lock: Switch expression dep to github: "turnhub/expression", branch: "release/3-0-0"
• lib/flow_runner.ex: Replace Expression.V2.Compat calls with Expression module; adapt evaluate_expression_block/2 for new {:ok, val} / {:error, reason} return type
• lib/flow_runner/custom_blocks/dynamic_select_one_response.ex: Same Expression.V2.Compat → Expression migration
• .github/workflows/*.yml: Pin actions/checkout, erlef/setup-beam, actions/cache, mikepenz/action-junit-report, and contributor-assistant/github-action to commit SHAs

Test plan

• CI passes with pinned actions
• All existing tests pass against expression 3.0.0-rc

🤖 Generated with Claude Code

[smn]

mostly a PR to see what the fall-out is from the breaking changes in the 3.X.X release candidates.

[santiagocardo]

LGTM, thanks @smn 🚀

[smn]

Cool. Before merging I'm going to be creating a PR in our product to see what the test fall out could be.

[jerith]

👋 Hi!

When I run our flow tester with this branch, the debug output for template messages doesn't evaluate the language code.

For example, we get "[DEBUG]\nTemplate mytemplate sent with language @template_lang.\n\n[...]" instead of "[DEBUG]\nTemplate mytemplate sent with language eng.\n\n[...] when the template block's language code is set to "@template_lang" with the variable value set to "eng" in the context.

[smn]

@jerith thanks! Yeah that's likely because we no longer automatically expand nested expressions anymore. I'll get a fix in to the flow runner for this because I don't think here that's a worthwhile breaking change.

[smn]

@jerith I've got a fix in for your issue but not entirely happy with it, that said, could you review it?

[smn]

latest expression now handles nested evaluations, it was a mistake to remove that.

[smn]

@jerith pls run against your stuff and see what breaks ?

[santiagocardo]

@smn, just a heads-up: changes here may be ported to the new simulator implementation in the product.

[jerith]

Looks like it's working after three changes to our code:

• Handle new error format in some expression edge case tests
• Handle uppercase context variables in time-faking expression function overrides
• Fix Tesla adapter config override to work without use Tesla

All of these are specific to our code and look like improvements to me. Thanks! 🎉

[smn]

thanks @jerith - that's good to hear