build(deps): bump actions/setup-node from 6 to 7

Bumps [actions/setup-node](https://github.com/actions/setup-node) from 6 to 7.
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@v6...v7)

---
updated-dependencies:
- dependency-name: actions/setup-node
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

Author: dependabot[bot]

.github/workflows/changesets.yml

@@ -40,7 +40,7 @@ jobs:
           run_install: false
 
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
         with:
           node-version: "22"
           cache: "pnpm"

.github/workflows/publish.yml

@@ -65,7 +65,7 @@ jobs:
         # `_authToken=${NODE_AUTH_TOKEN}` line into ~/.npmrc, which then
         # short-circuits the trusted-publisher OIDC handshake when no token is
         # present. The npm publish step passes --registry explicitly instead.
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
         with:
           node-version: "24"
           cache: "pnpm"
@@ -140,7 +140,7 @@ jobs:
           echo "npm — published: $published  skipped: $skipped"
 
       - name: Setup Node.js (GitHub Packages registry)
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
         with:
           node-version: "24"
           registry-url: "https://npm.pkg.github.com"

.github/workflows/test.yml

@@ -50,7 +50,7 @@ jobs:
           fetch-depth: 1
 
       - name: Setup Node.js ${{ matrix.node }}
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
         with:
           node-version: ${{ matrix.node }}