Bump the four GitHub Actions majors under the clean room standard

[Jason-Vaughan]

What

Bumps the four GitHub Actions majors Dependabot proposed, in one commit:

action	bump	supersedes
actions/checkout	4 → 7	#206
actions/setup-python	5 → 7	#204
actions/upload-artifact	4 → 7	#205
actions/download-artifact	4 → 8	#207

Reconstructed on main under the clean room standard in CONTRIBUTING.md — those four branches
were not merged, not checked out and not run locally. Under ADR-009 a bot's bytes get the same
treatment as anyone else's. They can be closed when this merges.

Why one PR and not four

The two artifact actions are coupled. From upload v7 / download v8 they share a direct-upload
contract: upload can skip zipping (archive: false) and download decides whether to decompress by
sniffing Content-Type. Neither option is used here — we upload a directory, so it zips, and the
round trip is by name — but merging them separately would leave a producer and a consumer of that
contract straddling it for as long as the second PR stayed open. The pairing rule is recorded in
publish.yml beside the steps, because a future session bumping one of them is exactly who needs it.

The audit

Full record: .prawduct/artifacts/queued-actions-bumps-204-207.md (untracked, per the
public-tree-product-only ruling).

Every target tag was verified as a real upstream release through the API rather than recalled — all
four postdate this session's model cutoff. Every major in every jump was read for breaking changes.

The jumps are smaller than they look. Three of the four crossed a major only to move to Node 24,
which the publishers themselves call "not a breaking change per-se but we're treating it as such".
Every genuine break across the seven majors is gated behind an input this project does not set or a
trigger it does not use:

• download-artifact v5 changed the path layout for artifacts fetched by ID; we fetch by name,
  which upstream's migration guide lists under "no action needed".
• setup-python v7 removed the pip-install input, never passed here.
• checkout v7 now refuses to check out a fork PR under pull_request_target or workflow_run.
  Neither workflow uses either trigger — and the hardening runs with this repo's fork-PR posture.
• setup-python v7 also carries a commit titled "remove EOL Python versions", the one plausible
  way this breaks a five-version matrix. It does not: reading that PR's file list, it touches only
  that action's own CI matrices and test fixtures, nothing about which interpreters it can install.

download-artifact v8 promotes a digest mismatch from a warning to an error. Taken deliberately
rather than by omission — this is the one path that feeds PyPI.

Runner floor (≥ v2.327.1 for three of the four) is met: both workflows are ubuntu-latest,
GitHub-hosted, no self-hosted runners.

The gap, stated rather than glossed

checkout@v7 and setup-python@v7 are proven — they touch ci.yml, so this PR's own matrix run
exercises them, as did the upstream PRs' (green on Python 3.10–3.14).

The artifact pair is not. It appears only in publish.yml, which fires on release: published,
so nothing here reaches it — the green checks on #205 and #207 ran the unchanged ci.yml and say
nothing about those actions. The next release is the first real exercise of that round trip.
Accepted because the usage is entirely default-shaped and the failure mode is a failed release job
after the tag is cut and before PyPI receives anything: loud, and recoverable.

Test plan

• make test — 805 passed, 17 skipped, lint + mypy green (make test depends on lint).
• This PR's CI matrix is itself the test of checkout@v7 and setup-python@v7 across 3.10–3.14.
• No test reaches publish.yml; see the gap above.

Notes

• Merge in the web UI. This touches .github/workflows/, and gh pr merge fails on the missing
  workflow OAuth scope. (The SSH push was unaffected.) CLAUDE.md also forbids --auto on
  anything touching CI or deploy config, so this one waits for you either way.
• .prawduct/change-log.md entry written and hand-checked; check-change-log-entry cannot see it
  because .prawduct/ is gitignored here (prawduct-upstream: [chore] change-log gate unsatisfiable when gitignored #180).
• The five pip bumps (build(deps-dev): update ruff requirement from <0.17,>=0.16 to >=0.16.6,<0.17 #208–build(deps-dev): update mypy requirement from <2.4,>=2.3 to >=2.3.1,<2.4 #212) are untouched, per the Coordinator's instruction — two are runtime
  floor raises that owe a deprecation announcement.
• Noted, not fixed, now tracked: these actions are pinned by mutable major tag, not full SHA —
  filed as [chore] Pin GitHub Actions to full commit SHAs, not mutable major tags #219. Out of scope for a version bump; it is a posture change.

Critic review

rev-20260908T213506Z-dbdb1ae6 (cumulative) — 0 blocking, 3 warning, 3 note. Nothing gated.
All six dispositioned; the three warnings are fixed rather than waved through:

• Test evidence predated the reviewed commit — re-recorded. The finding also caught a real
  arithmetic slip: Ran 805 is the total including the 17 skipped, so passed is 788, not 805.
• The deferred SHA-pinning decision had no tracked home — filed as [chore] Pin GitHub Actions to full commit SHAs, not mutable major tags #219.
• Dependabot's pip ecosystem sits at its 5-PR ceiling with five ungrouped PRs, when
  python-minor-and-patch should have collapsed four of them — filed as [bug] Dependabot's pip group did not collapse four minor/patch bumps, and the ecosystem is now at its PR ceiling #220. Verified before
  filing: Watch Python dependencies and workflow actions with Dependabot #203 merged at 06:26:06Z and all nine PRs opened within 95 seconds, so the config was
  read. Root cause not diagnosed; the next weekly run is the free discriminator, and the
  recommendation is to change nothing until it reports. This is why the pip ceiling matters now:
  a new pip major currently cannot open a PR.