chore(ci): one pass over action pins instead of four dependency PRs

.github/dependabot.yml

@@ -6,6 +6,14 @@ updates:
     schedule:
       interval: weekly
     open-pull-requests-limit: 5
+    ignore:
+      # Pinned deliberately, with the reason in a comment beside the pin. On
+      # 2026-10-25 Dependabot changed this pin's SHA while leaving a comment
+      # that said v4.38.0 / "4.38.1 blocked estate-wide" - a change nobody could
+      # review without resolving the SHA by hand. Action pins that carry an
+      # estate-wide decision are updated by hand.
+      - dependency-name: github/codeql-action
+        update-types: [version-update:semver-major, version-update:semver-minor, version-update:semver-patch]
     # A dependency pull request is a one-line diff that becomes stale the
     # moment anything else merges, and the Branch freshness check then fails it
     # on a rule the dependency did not break. Dependabot's default is not to

.github/workflows/ci.yml

@@ -271,7 +271,7 @@ jobs:
       # the restore runs as root. The run id makes each key unique so every attempt
       # saves its progress; restore-keys picks the newest match.
       - name: Restore the renv cache
-        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830  # v4.3.0
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v6.1.0
         with:
           path: /opt/renv-cache
           key: renv-${{ runner.os }}-R${{ env.R_APT_VERSION }}-${{ hashFiles('renv.lock') }}-${{ github.run_id }}
@@ -307,7 +307,7 @@ jobs:
 
       - name: Save the renv cache
         if: always()
-        uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830  # v4.3.0
+        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v6.1.0
         with:
           path: /opt/renv-cache
           key: renv-${{ runner.os }}-R${{ env.R_APT_VERSION }}-${{ hashFiles('renv.lock') }}-${{ github.run_id }}
@@ -609,7 +609,7 @@ jobs:
 
       - name: Retain statistics evidence
         if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4.6.2
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7.0.2
         with:
           name: statistics-standards
           path: |

.github/workflows/hypatia-scan-reusable.yml

@@ -671,7 +671,7 @@ jobs:
         # This flag only tolerates a genuine upload failure (e.g. Advanced
         # Security disabled on a private repo) once the job is actually running.
         continue-on-error: true
-        uses: github/codeql-action/upload-sarif@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.38.0 (4.38.1 blocked estate-wide; nexia-list#100)
+        uses: github/codeql-action/upload-sarif@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee  # v4.39.0 (the SHA, not the tag, is pinned: Dependabot resolves it to 4.39.0)
         with:
           sarif_file: hypatia-effective.sarif
           category: hypatia

.github/workflows/null-calibration-comparators.yml

@@ -131,7 +131,7 @@ jobs:
       # dada2, vegan, glmGamPoi and their dependencies from source on every run,
       # which is most of the wall clock and none of the information.
       - name: Restore the renv cache
-        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830  # v4.3.0
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v6.1.0
         with:
           path: /opt/renv-cache
           key: renv-${{ runner.os }}-R${{ env.R_APT_VERSION }}-${{ hashFiles('renv.lock') }}-${{ github.run_id }}
@@ -160,7 +160,7 @@ jobs:
 
       - name: Save the renv cache
         if: always()
-        uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830  # v4.3.0
+        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v6.1.0
         with:
           path: /opt/renv-cache
           key: renv-${{ runner.os }}-R${{ env.R_APT_VERSION }}-${{ hashFiles('renv.lock') }}-${{ github.run_id }}
@@ -296,7 +296,7 @@ jobs:
 
       - name: Retain the raw cells
         if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4.6.2
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7.0.2
         with:
           name: null-calibration-raw
           path: |