chore(deps): consolidate compatible dependency updates

.github/workflows/ai-eval.yml

@@ -67,7 +67,7 @@ jobs:
     runs-on: ${{ inputs.runner || 'ubuntu-latest' }}
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - uses: actions/setup-go@v6
         with:
           go-version-file: go.mod
@@ -89,7 +89,7 @@ jobs:
     runs-on: ${{ inputs.runner || 'ubuntu-latest' }}
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - uses: actions/setup-go@v6
         with:
           go-version-file: go.mod
@@ -100,7 +100,7 @@ jobs:
         run: make ai-eval-full
       - name: Upload JUnit report
         if: always()
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7.0.1
         with:
           name: ai-eval-junit
           path: ai-eval.junit.xml
@@ -115,7 +115,7 @@ jobs:
       JUDGE_PROVIDER: ${{ secrets.JUDGE_PROVIDER }}
       JUDGE_API_KEY: ${{ secrets.JUDGE_API_KEY }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - uses: actions/setup-go@v6
         with:
           go-version-file: go.mod
@@ -134,7 +134,7 @@ jobs:
         run: make ai-eval-judged
       - name: Upload judged JUnit report
         if: steps.gate.outputs.judge == 'enabled'
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7.0.1
         with:
           name: ai-eval-judged-junit
           path: ai-eval.judged.junit.xml

.github/workflows/backup-restore-drill.yml

@@ -74,7 +74,7 @@ jobs:
       TARGET_DB: teslasync_drill_restored
       TARGET_GUARD: restore-drill-${{ github.run_id }}-${{ github.run_attempt }}
     steps:
-      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
         with:
@@ -417,7 +417,7 @@ jobs:
 
       - name: Upload drill evidence
         if: always()
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: restore-drill-${{ github.run_id }}-${{ github.run_attempt }}
           path: |

.github/workflows/capacity-test.yml

@@ -61,7 +61,7 @@ jobs:
     # Below safety.max_duration (30m) with room for stack boot/teardown.
     timeout-minutes: 40
     steps:
-      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
         with:
@@ -126,7 +126,7 @@ jobs:
 
       - name: Install k6
         if: ${{ inputs.profile != 'reconnect-storm' }}
-        uses: grafana/setup-k6-action@db07bd9765aac508ef18982e52ab937fe633a065 # v1.2.1
+        uses: grafana/setup-k6-action@43b9fc21641a76002687994433dd586f56e791b1 # v1.2.2
         with:
           k6-version: v1.8.1
 
@@ -266,7 +266,7 @@ jobs:
 
       - name: Upload k6 summaries
         if: always()
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: capacity-${{ inputs.profile }}-${{ github.run_number }}
           path: |

.github/workflows/ci.yml

@@ -41,7 +41,7 @@ jobs:
     # feature mirror, the SLO rules/dashboards).
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - uses: actions/setup-node@v5
         with:
           node-version: "26"
@@ -73,7 +73,7 @@ jobs:
       matrix:
         check: [lint, architecture]
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - uses: actions/setup-go@v6
         with:
           go-version-file: go.mod
@@ -120,7 +120,7 @@ jobs:
           --health-timeout 5s
           --health-retries 10
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - uses: actions/setup-go@v6
         with:
           go-version-file: go.mod
@@ -140,7 +140,7 @@ jobs:
           go test -race -coverprofile=shard/coverage.out -covermode=atomic -json "${packages[@]}" | tee shard/test-events.json
       - name: Upload raw shard evidence
         if: always()
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7.0.1
         with:
           name: backend-test-${{ matrix.shard }}
           path: shard/
@@ -155,7 +155,7 @@ jobs:
     env:
       CGO_ENABLED: 1
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - uses: actions/setup-go@v6
         with:
           go-version-file: go.mod
@@ -182,7 +182,7 @@ jobs:
 
       - name: Upload coverage
         if: always()
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7.0.1
         with:
           name: backend-coverage
           if-no-files-found: error
@@ -217,7 +217,7 @@ jobs:
           --health-timeout 5s
           --health-retries 10
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - uses: actions/setup-go@v6
         with:
           go-version-file: go.mod
@@ -267,7 +267,7 @@ jobs:
       matrix:
         binary: [teslasync, notification-worker, export-worker]
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - uses: actions/setup-go@v6
         with:
           go-version-file: go.mod
@@ -299,7 +299,7 @@ jobs:
       run:
         working-directory: web
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - uses: actions/setup-node@v5
         with:
           node-version: "26"
@@ -337,7 +337,7 @@ jobs:
       run:
         working-directory: web
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - uses: actions/setup-node@v5
         with:
           node-version: "26"
@@ -353,7 +353,7 @@ jobs:
             --reporter=default --reporter=blob
       - name: Upload raw shard evidence
         if: always()
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7.0.1
         with:
           name: frontend-test-${{ matrix.shard }}
           path: web/.vitest-reports/
@@ -370,7 +370,7 @@ jobs:
       run:
         working-directory: web
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-node@v5
         with:
@@ -405,7 +405,7 @@ jobs:
 
       - name: Upload coverage
         if: always()
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7.0.1
         with:
           name: frontend-coverage
           path: web/coverage/
@@ -447,7 +447,7 @@ jobs:
           - image: web
             file: Dockerfile.web
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - uses: docker/setup-buildx-action@v4
 
       - name: Build ${{ matrix.image }}

.github/workflows/cleanup.yml

@@ -35,7 +35,7 @@ jobs:
       contents: read
       packages: write
     steps:
-      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: actions/setup-node@v5
         with:
           node-version: '22'
@@ -49,7 +49,7 @@ jobs:
         run: node scripts/package-retention.mjs
       - name: Upload retention report
         if: always()
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: package-retention-report
           path: |

.github/workflows/copilot-setup-steps.yml

@@ -32,7 +32,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
 
       # ── Go toolchain ──────────────────────────────────────────
       - name: Set up Go

.github/workflows/deploy-rollback.yml

@@ -96,7 +96,7 @@ jobs:
       verdict: ${{ steps.evaluate.outputs.verdict }}
       automation_allowed: ${{ steps.evaluate.outputs.automation_allowed }}
     steps:
-      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
         with:
@@ -155,7 +155,7 @@ jobs:
 
       - name: Upload decision
         if: always()
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: rollback-decision-${{ github.run_number }}
           path: decision.json
@@ -189,7 +189,7 @@ jobs:
     # a production rollback safe.
     environment: ${{ inputs.environment }}
     steps:
-      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
         with:

.github/workflows/docs.yml

@@ -32,7 +32,7 @@ jobs:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 

.github/workflows/fleet-proto-drift.yml

@@ -17,7 +17,7 @@ jobs:
   check:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - name: Test the drift detector
         run: python3 -m unittest discover -s scripts -p 'test_check_fleet_proto_drift.py'
       - name: Fetch the current upstream schema at a fixed revision

.github/workflows/frontend-quality.yml

@@ -40,7 +40,7 @@ jobs:
     name: Route registry and test discovery
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - uses: actions/setup-node@v5
         with:
           node-version: '26'
@@ -73,7 +73,7 @@ jobs:
     name: Shared hermetic browser build
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - uses: actions/setup-node@v5
         with:
           node-version: '26'
@@ -83,7 +83,7 @@ jobs:
       - run: npm run e2e:build
         env:
           E2E_MOCKS: '1'
-      - uses: actions/upload-artifact@v6
+      - uses: actions/upload-artifact@v7.0.1
         with:
           name: e2e-app
           path: web/e2e/.app-dist/
@@ -106,7 +106,7 @@ jobs:
           - {name: accessibility, suite: a11y, shard: '1/1'}
           - {name: performance, suite: performance, shard: '1/1'}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - uses: actions/setup-node@v5
         with:
           node-version: '26'
@@ -125,7 +125,7 @@ jobs:
         run: npm run e2e:${{ matrix.suite }} -- --shard=${{ matrix.shard }}
       - name: Upload Chromium failure evidence
         if: always()
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7.0.1
         with:
           name: chromium-${{ matrix.name }}-report
           if-no-files-found: ignore
@@ -158,7 +158,7 @@ jobs:
       matrix:
         browser: [firefox, webkit]
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - uses: actions/setup-node@v5
         with:
           node-version: '26'
@@ -177,7 +177,7 @@ jobs:
         run: npm run e2e -- --project=${{ matrix.browser }}-smoke
       - name: Upload engine failure evidence
         if: always()
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7.0.1
         with:
           name: ${{ matrix.browser }}-smoke-report
           if-no-files-found: ignore
@@ -195,7 +195,7 @@ jobs:
       matrix:
         shard: [1, 2, 3, 4]
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - uses: actions/setup-node@v5
         with:
           node-version: '26'
@@ -214,7 +214,7 @@ jobs:
         run: npm run e2e:visual -- --shard=${{ matrix.shard }}/4 --workers=2
       - name: Upload visual diffs
         if: always()
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7.0.1
         with:
           name: visual-regression-report-${{ matrix.shard }}
           if-no-files-found: ignore
@@ -244,7 +244,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: contract
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - uses: actions/setup-node@v5
         with:
           node-version: '26'
@@ -283,7 +283,7 @@ jobs:
           rm -rf test-results playwright-report blob-report
       - name: Upload sanitized deployed smoke status
         if: always()
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7.0.1
         with:
           name: authenticated-production-smoke-status
           if-no-files-found: error