Bump actions/checkout from 6.0.3 to 7.0.1

Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.3 to 7.0.1.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@df4cb1c...3d3c42e)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

Author: dependabot[bot]

.github/workflows/ci.yml

@@ -1,67 +1,67 @@
-name: CI
-
-on:
-  push:
-    branches: [main]
-  pull_request:
-
-# Least privilege: this workflow only needs to read the repo.
-permissions:
-  contents: read
-
-# Cancel superseded runs for the same ref to save CI minutes.
-concurrency:
-  group: ci-${{ github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  check:
-    runs-on: ubuntu-latest
-    strategy:
-      # Test the oldest Node we claim to support (package.json engines)
-      # alongside current, so "works on my machine" can't hide an engines
-      # violation.
-      matrix:
-        node-version: [22, 24]
-    steps:
-      # Actions are pinned to commit SHAs (supply-chain hardening); the
-      # trailing comment records the human-readable version. v6 runs on the
-      # Node 24 action runtime, clearing the Node 20 deprecation warning.
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-        with:
-          # No step here pushes or calls the API; don't leave the token in
-          # .git/config for the rest of the job.
-          persist-credentials: false
-
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-        with:
-          node-version: ${{ matrix.node-version }}
-          cache: npm
-
-      - run: npm ci
-
-      - name: Validate manifest.json parses
-        run: node -e "JSON.parse(require('fs').readFileSync('manifest.json','utf8'))"
-
-      - run: npm run lint
-
-      - run: npm run format:check
-
-      - run: npm run typecheck
-
-      - run: npm run coverage
-
-      - run: npm run build
-
-  # Merge gate: branch protection requires a single status named "check".
-  # Reporting that name from an aggregate job (instead of the matrix legs,
-  # whose names carry the Node version) keeps the required-check name
-  # stable no matter how the matrix changes.
-  ci-ok:
-    name: check
-    needs: check
-    if: always()
-    runs-on: ubuntu-latest
-    steps:
-      - name: Fail unless every matrix leg succeeded
-        run: test "${{ needs.check.result }}" = "success"
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+# Least privilege: this workflow only needs to read the repo.
+permissions:
+  contents: read
+
+# Cancel superseded runs for the same ref to save CI minutes.
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    strategy:
+      # Test the oldest Node we claim to support (package.json engines)
+      # alongside current, so "works on my machine" can't hide an engines
+      # violation.
+      matrix:
+        node-version: [22, 24]
+    steps:
+      # Actions are pinned to commit SHAs (supply-chain hardening); the
+      # trailing comment records the human-readable version. v6 runs on the
+      # Node 24 action runtime, clearing the Node 20 deprecation warning.
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          # No step here pushes or calls the API; don't leave the token in
+          # .git/config for the rest of the job.
+          persist-credentials: false
+
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: ${{ matrix.node-version }}
+          cache: npm
+
+      - run: npm ci
+
+      - name: Validate manifest.json parses
+        run: node -e "JSON.parse(require('fs').readFileSync('manifest.json','utf8'))"
+
+      - run: npm run lint
+
+      - run: npm run format:check
+
+      - run: npm run typecheck
+
+      - run: npm run coverage
+
+      - run: npm run build
+
+  # Merge gate: branch protection requires a single status named "check".
+  # Reporting that name from an aggregate job (instead of the matrix legs,
+  # whose names carry the Node version) keeps the required-check name
+  # stable no matter how the matrix changes.
+  ci-ok:
+    name: check
+    needs: check
+    if: always()
+    runs-on: ubuntu-latest
+    steps:
+      - name: Fail unless every matrix leg succeeded
+        run: test "${{ needs.check.result }}" = "success"

.github/workflows/codeql.yml

@@ -1,41 +1,41 @@
-name: CodeQL
-
-on:
-  push:
-    branches: [main]
-  pull_request:
-    branches: [main]
-  schedule:
-    # Weekly scan to catch advisories in code that hasn't changed.
-    - cron: "27 4 * * 1"
-
-permissions:
-  contents: read
-
-jobs:
-  analyze:
-    name: Analyze
-    runs-on: ubuntu-latest
-    permissions:
-      # Required for CodeQL to upload results to code scanning.
-      security-events: write
-      actions: read
-      contents: read
-    strategy:
-      fail-fast: false
-      matrix:
-        language: [javascript-typescript]
-    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-
-      - name: Initialize CodeQL
-        uses: github/codeql-action/init@84498526a009a99c875e83ef4821a8ba52de7c22 # codeql-bundle-v2.25.5
-        with:
-          languages: ${{ matrix.language }}
-          # Static assets only; no compiled languages to build.
-          build-mode: none
-
-      - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@84498526a009a99c875e83ef4821a8ba52de7c22 # codeql-bundle-v2.25.5
-        with:
-          category: "/language:${{ matrix.language }}"
+name: CodeQL
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    # Weekly scan to catch advisories in code that hasn't changed.
+    - cron: "27 4 * * 1"
+
+permissions:
+  contents: read
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    permissions:
+      # Required for CodeQL to upload results to code scanning.
+      security-events: write
+      actions: read
+      contents: read
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [javascript-typescript]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@84498526a009a99c875e83ef4821a8ba52de7c22 # codeql-bundle-v2.25.5
+        with:
+          languages: ${{ matrix.language }}
+          # Static assets only; no compiled languages to build.
+          build-mode: none
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@84498526a009a99c875e83ef4821a8ba52de7c22 # codeql-bundle-v2.25.5
+        with:
+          category: "/language:${{ matrix.language }}"