Migrate generated workflows to pinned actions/checkout v7.0.1

[jeffhuber]

Context

Dependabot opened #431 to bump checked-in generated workflows from the pinned actions/checkout v6 SHA to the pinned v7.0.1 SHA. That PR was closed because it did not update Code Mower's workflow templates, so future generated workflows would keep emitting the old checkout pin.

Scope

Update the checkout pin as a template-owned migration:

• Update both workflow template trees to use the pinned actions/checkout v7.0.1 commit SHA.
• Regenerate Code Mower's checked-in workflows from the updated templates.
• Keep privileged-event behavior explicit: trusted support files come from the default branch; PR-head checkouts remain same-repo guarded.
• Add or update release-hygiene tests so the old checkout pin does not return.
• Add a short doc/release note line explaining the migration.

Acceptance Criteria

• Generated workflows use the same pinned checkout v7.0.1 SHA where Code Mower owns the template.
• No generated workflow uses the old pinned checkout v6 SHA.
• Existing fork/same-repo audit safety posture is unchanged.
• Focused tests, actionlint, and Code Mower gate pass.