chore(deps): Bump actions/checkout from 4 to 7

.github/workflows/agent-host-maintenance.yml

@@ -43,7 +43,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Determine image tag
         id: tag

.github/workflows/ci.yml

@@ -49,7 +49,7 @@ jobs:
       docs: ${{ steps.filter.outputs.docs }}
       diagrams: ${{ steps.filter.outputs.diagrams }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       # dorny/paths-filter classifies the PR/push diff into named groups below.
       # Every group includes .github/workflows/** so a change to this pipeline
       # itself always trips every downstream job, never leaving a suite skipped
@@ -102,7 +102,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Set up .NET SDK
         uses: actions/setup-dotnet@v6
@@ -194,7 +194,7 @@ jobs:
     if: needs.changes.outputs.node-toolchain == 'true'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Set up Node.js
         uses: actions/setup-node@v7
@@ -217,7 +217,7 @@ jobs:
     if: needs.changes.outputs.web == 'true'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Set up Node.js
         uses: actions/setup-node@v7
@@ -247,7 +247,7 @@ jobs:
     if: needs.changes.outputs.docs == 'true'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Set up Node.js
         uses: actions/setup-node@v7
@@ -267,7 +267,7 @@ jobs:
     if: needs.changes.outputs.diagrams == 'true'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Set up Node.js
         uses: actions/setup-node@v7
@@ -299,7 +299,7 @@ jobs:
     if: github.event_name == 'pull_request' && (github.base_ref == 'dev' || startsWith(github.base_ref, 'release/v'))
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
       - uses: actions/setup-node@v7

.github/workflows/deploy-docs.yml

@@ -24,7 +24,7 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-node@v7
         with:

.github/workflows/docs-drift.yml

@@ -28,7 +28,7 @@ jobs:
     name: Generated reference is in sync
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-node@v7
         with:
@@ -50,7 +50,7 @@ jobs:
     name: Curated docs drift (warn only)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 

.github/workflows/publish-images.yml

@@ -73,7 +73,7 @@ jobs:
       primary_tag: ${{ steps.plan.outputs.primary_tag }}
       matrix: ${{ steps.plan.outputs.matrix }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-node@v7
         with:
@@ -110,7 +110,7 @@ jobs:
       fail-fast: false
       matrix: ${{ fromJSON(needs.plan.outputs.matrix) }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       # apps/web/Dockerfile deliberately never runs npm itself: it copies the
       # prebuilt apps/web/dist produced here, matching what the ACR build path

.github/workflows/squad-heartbeat.yml

@@ -25,7 +25,7 @@ jobs:
   heartbeat:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Check triage script
         id: check-script

.github/workflows/squad-issue-assign.yml

@@ -14,7 +14,7 @@ jobs:
     if: startsWith(github.event.label.name, 'squad:')
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Identify assigned member and trigger work
         uses: actions/github-script@v9

.github/workflows/squad-label-enforce.yml

@@ -12,7 +12,7 @@ jobs:
   enforce:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Enforce mutual exclusivity
         uses: actions/github-script@v9

.github/workflows/squad-triage.yml

@@ -13,7 +13,7 @@ jobs:
     if: github.event.label.name == 'squad'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Triage issue via Lead agent
         uses: actions/github-script@v9

.github/workflows/sync-squad-labels.yml

@@ -16,7 +16,7 @@ jobs:
   sync-labels:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Parse roster and sync labels
         uses: actions/github-script@v9