chore(ci): refresh actions and docs metadata

[itg-karthicr]

Summary

• Refresh docs-facing copyright metadata to 2026, IVR Technology Group without publishing an email address.
• Move GitHub Actions workflow dependencies to the next major versions that replace the deprecated Node 20 runtime.
• Add Dependabot monitoring for GitHub Actions.

Validation

• python -m pytest -q
• ruff check .
• ruff format --check .
• python -m sphinx -W --keep-going -b html doc doc/_build/html
• python -m build
• python -m twine check dist/*

Notes

• The optional Read the Docs v1.3.0 activation from Post-1.3.0 polish: copyright, Node 20 actions, RTD version #60 is a dashboard setting, not a repository change.

Addresses #60.

[itg-karthicr]

Addressed the scoped review findings:

• Updated the publish workflow artifact actions to current majors: actions/upload-artifact@v7 and actions/download-artifact@v8.
• Verified upstream current releases via GitHub API: upload-artifact v7.0.1, download-artifact v8.0.1.
• Verified the major refs used in the workflow both declare runs.using: node24 in action.yml.
• Re-ran local checks: ruff check ., ruff format --check ., python -m pytest -q, python -m build, python -m twine check dist/*, and git diff --check.

This addresses the Node 20 artifact-action gap and records the release-workflow verification that PR CI does not exercise.

[itg-karthicr]

Review Panel — Round 1

Base: master | Diff range: master...origin/chore/issue-60-post-1-3-polish | Reviewers: Codex, general-purpose, code-reviewer, silent-failure-hunter (4/4)

---

Warning

1. checkout@v5 is two major versions behind — .github/workflows/ci.yml (all 4 checkout steps) and .github/workflows/publish.yml (build job)

All 4 reviewers flagged this. The PR's intent is to move to "current Node 24-backed major versions." The current latest is actions/checkout@v7 (released 2026-06-18). @v5 (released 2025-11-17) is real and Node 24-backed but is not current. The CHANGELOG claim of "current Node 24-backed major versions" is inaccurate for checkout specifically.

Fix: bump all five actions/checkout@v5 references to actions/checkout@v7.

---

2. upload-artifact@v7 + download-artifact@v8 pairing needs inline comments — .github/workflows/publish.yml

The v7/v8 version gap is intentional — both actions were released as a matched pair on the same day (2026-02-26) and share the same artifact service API revision. The PR has the pairing correct. The risk is that Dependabot (which this PR adds) will auto-bump each action independently and silently break the pairing. A mismatch fails only at download time with a confusing "no artifact found" error, not at upload.

Fix: add inline comments tying the two together:

- uses: actions/upload-artifact@v7  # must stay in sync with download-artifact version in the publish job

- uses: actions/download-artifact@v8  # must match the upload-artifact major used in the build job

---

Confirmed correct

• setup-python@v6, upload-artifact@v7, download-artifact@v8 — verified as current latest majors.
• pypa/gh-action-pypi-publish@release/v1 — not bumped intentionally; PyPA recommends the floating @release/v1 reference for Trusted Publishing.
• doc/conf.py split(", ", 1)[1] — correctly extracts IVR Technology Group; migration from the old email-extracting regex is complete with no other usages remaining.
• Dependabot directory: "/" correctly covers both workflow files.
• CHANGELOG.md format follows Keep a Changelog convention.
• COPYRIGHT consumers: only doc/conf.py — no other code breaks from removing the email.

[itg-karthicr]

Updated the PR to address the latest review feedback:

• Bumped all actions/checkout references from @v5 to current major @v7 across .github/workflows/ci.yml and .github/workflows/publish.yml.
• Confirmed actions/checkout@v7 is the current release line (v7.0.0) and declares runs.using: node24.
• Kept actions/upload-artifact@v7 and actions/download-artifact@v8, which are the current release lines (v7.0.1 and v8.0.1) and both declare runs.using: node24.
• Added inline comments in publish.yml documenting that the upload/download artifact actions are intentionally paired across the build and publish jobs, so future dependency updates should keep them coordinated.

Verification run:

• ruff check .
• ruff format --check .
• python -m pytest -q
• python -m build
• python -m twine check dist/*
• git diff --check

The amended branch is pushed as 28f5628 chore(ci): refresh actions and docs metadata, and all remote PR checks are passing.

[itg-karthicr]

Review Panel — Round 2

Reviewers: Codex, general-purpose, code-reviewer (3/3) | Verdict: panel satisfied

Both round-1 warnings are resolved:

• actions/checkout@v7 confirmed across all 5 occurrences (ci.yml lines 17, 38, 53, 70; publish.yml line 24). No @v5 references remain.
• Artifact pairing comments are accurate and cross-referencing in both directions.

No new findings. PR is ready to merge.