ci: bump actions/checkout from 4 to 7

.github/workflows/ci.yml

@@ -9,7 +9,7 @@ jobs:
   backend-tests:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: astral-sh/setup-uv@v5
       - name: Install (matches the documented dev venv, not --all-extras)
         run: uv sync --extra pii --extra classifiers --extra otel --extra postgres --extra sql --extra dev
@@ -36,7 +36,7 @@ jobs:
   enterprise-tests:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: astral-sh/setup-uv@v5
       - name: Install the open core, then the enterprise package beside it
         run: |
@@ -50,7 +50,7 @@ jobs:
       run:
         working-directory: dashboard
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: actions/setup-node@v4
         with:
           node-version: "20"
@@ -74,7 +74,7 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: astral-sh/setup-uv@v5
       # Pinned, and pinned to the version the repo was actually cleaned with.
       # `ruff format` output differs between releases, so an unpinned
@@ -92,7 +92,7 @@ jobs:
   docker-smoke:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: docker/setup-buildx-action@v3
       - uses: docker/build-push-action@v6
         with:
@@ -107,7 +107,7 @@ jobs:
   github-action:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: A repository with a trifecta
         run: |
           mkdir -p "$RUNNER_TEMP/sample"
@@ -130,7 +130,7 @@ jobs:
   vendored-wheel-freshness:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
       - name: Fail if src/agentfox changed without rebuilding the vendored wheels

.github/workflows/labels.yml

@@ -29,7 +29,7 @@ jobs:
   sync:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Install the YAML parser
         run: python3 -m pip install --quiet pyyaml

.github/workflows/nightly.yml

@@ -17,7 +17,7 @@ jobs:
     # measured yet, so this leaves room rather than guessing tight.
     timeout-minutes: 90
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: astral-sh/setup-uv@v5
       - name: Install (matches CI)
         run: uv sync --extra pii --extra otel --extra postgres --extra sql --extra dev

.github/workflows/publish-images.yml

@@ -55,7 +55,7 @@ jobs:
           - arch: arm64
             runner: ubuntu-24.04-arm
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - uses: docker/setup-buildx-action@v3
 

.github/workflows/release-sdk.yml

@@ -27,7 +27,7 @@ jobs:
       run:
         working-directory: sdk/typescript
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-node@v4
         with:

.github/workflows/release.yml

@@ -30,7 +30,7 @@ jobs:
   release:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - uses: astral-sh/setup-uv@v5
 
@@ -196,7 +196,7 @@ jobs:
       id-token: write
       contents: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: astral-sh/setup-uv@v5
 
       # Rebuilt rather than carried over from `release`: an artefact that moved