chore(deps): update actions/checkout action to v7

[mergeraptor]

This PR contains the following updates:

Package	Type	Update	Change
actions/checkout	action	major	v6 → v7

---

Release Notes

actions/checkout (actions/checkout)

v7.0.1

Compare Source

• Skip running unsafe pr check if input is default by @​aiqiaoy in #​2518
• Trim only ascii whitespace for branch by @​aiqiaoy in #​2521
• Escape values passed to --unset by @​aiqiaoy in #​2530
• Various dependency updates

v7.0.0

Compare Source

• Block checking out fork PR for pull_request_target and workflow_run by @​aiqiaoy in #​2454
• Various dependency updates

v7

Compare Source

• Skip running unsafe pr check if input is default by @​aiqiaoy in #​2518
• Trim only ascii whitespace for branch by @​aiqiaoy in #​2521
• Escape values passed to --unset by @​aiqiaoy in #​2530
• Various dependency updates

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Never, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[github-actions]

Thanks for the PR! A maintainer will review it.

While you wait, make sure these pass locally:

just validate        # element graph check
just build default   # build the image
just boot-test       # confirm the desktop boots (exits 0 = pass)
just lint            # bootc container lint

If this PR fixes a bug, add verify steps to the linked issue so users can confirm the fix on their hardware after the next nightly ships:

```verify
ujust <something>   # what users should run to confirm the fix
```

[hanthor]

Review: scope mismatch

The PR title says "chore(deps): update actions/checkout action to v7" but the diff includes two changes:

1. ✅ The Renovate dep bump (actions/checkout v6→v7)
2. ❓ A standalone aarch64 CI build workflow — this adds a ~174-line new workflow file, refactors build.yml, and introduces docs/skills/aarch64.md

These are two independent changes. Consider either:

• Option A: Rename the PR to cover both changes (e.g. feat(ci): add aarch64 build workflow and update actions/checkout)
• Option B: Split the aarch64 work into its own PR so the dep bump can merge independently

The aarch64 CI changes may warrant their own review cycle regardless. Label pr/needs-review is correct — this one needs a human decision.

[hanthor]

LGTM. Reviewed 2026-06-24.

[castrojo]

BLOCKED — ghost lab validation not run

PR is CONFLICTING with testing; lab validation skipped. Renovate rebase checkbox was ticked but the branch remains conflicting (Renovate config: rebasing "Never, or you tick the rebase/retry checkbox" — rebase has not landed yet or conflicts need manual resolution).

• Action: waiting on Renovate rebase; if it stays conflicting, resolve the checkout v7 workflow conflicts manually.

[github-actions]

Changes requested by @hanthor. Address the review comments, push a new commit, and the PR will be re-queued for review.