build(deps): bump actions/checkout from 4 to 7

Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 7.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v4...v7)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

Author: dependabot[bot]

.github/workflows/chaos.yml

@@ -78,7 +78,7 @@ jobs:
     name: The QR2 verdict can fail, and does not gate the latency
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: The rig's opt-in is three-way, and the middle case is a failure
         # `scripts/run-chaos-qr2.sh` skips with a reason when FLOWX_CHAOS is unset and FAILS
@@ -251,7 +251,7 @@ jobs:
           --health-retries 20
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: actions/setup-dotnet@v4
         with:
           global-json-file: global.json

.github/workflows/ci.yml

@@ -77,7 +77,7 @@ jobs:
           - 1433:1433
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-dotnet@v4
         with:
@@ -220,7 +220,7 @@ jobs:
     name: dotnet new flowx
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: actions/setup-dotnet@v4
         with:
           global-json-file: global.json
@@ -247,7 +247,7 @@ jobs:
     name: NativeAOT smoke test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: actions/setup-dotnet@v4
         with:
           global-json-file: global.json
@@ -355,7 +355,7 @@ jobs:
     name: Manifest compatibility
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: actions/setup-dotnet@v4
         with:
           global-json-file: global.json
@@ -399,7 +399,7 @@ jobs:
     name: Documentation gates
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-dotnet@v4
         with:
@@ -513,7 +513,7 @@ jobs:
     name: Attribution guard
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -571,7 +571,7 @@ jobs:
       # reaches a named person's notifications.
       issues: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Open, update or close the tracking issue
         env:

.github/workflows/performance.yml

@@ -34,7 +34,7 @@ jobs:
     name: Allocation budget (B2, and B6's allocation half)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: actions/setup-dotnet@v4
         with:
           global-json-file: global.json
@@ -56,7 +56,7 @@ jobs:
     name: Benchmark budgets (B1, B3, B12 isolated)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: actions/setup-dotnet@v4
         with:
           global-json-file: global.json
@@ -95,7 +95,7 @@ jobs:
     name: Budget B12 — build overhead
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: actions/setup-dotnet@v4
         with:
           global-json-file: global.json
@@ -146,7 +146,7 @@ jobs:
     # is a wall-clock question, `scale-overhead` is the instrument for it, and it fails.
     # The checker reprints that criterion on every run, including passing ones.
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: actions/setup-dotnet@v4
         with:
           global-json-file: global.json
@@ -233,7 +233,7 @@ jobs:
     name: The generator-cost gate can fail
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: A regression under the threshold must fail the gate
         # A gate nobody has seen fail is an assumption, not a gate — the same argument
@@ -324,7 +324,7 @@ jobs:
     #   esac
     continue-on-error: true
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: actions/setup-dotnet@v4
         with:
           global-json-file: global.json
@@ -358,7 +358,7 @@ jobs:
     name: The gate can fail
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Injecting a regression must fail the gate
         # A gate nobody has seen fail is an assumption, not a gate. This builds a

.github/workflows/quality.yml

@@ -68,7 +68,7 @@ jobs:
         ports:
           - 1433:1433
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: actions/setup-dotnet@v4
         with:
           global-json-file: global.json
@@ -233,7 +233,7 @@ jobs:
     # missing secret would just teach contributors that red is normal.
     if: github.event.pull_request.head.repo.full_name == github.repository || github.event_name == 'push'
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0   # Sonar needs history for new-code detection
 
@@ -297,7 +297,7 @@ jobs:
     # a failure somebody looks at.
     timeout-minutes: 25
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: actions/setup-dotnet@v4
         with:
           global-json-file: global.json
@@ -349,7 +349,7 @@ jobs:
     # a rule that already has one — to be kept in step by hand, forever, with no
     # test that they agree.
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: No unaccountable TODOs
         # Every tree that ships or is read as an example, not just src and tests. A

.github/workflows/security.yml

@@ -23,7 +23,7 @@ jobs:
       security-events: write
       contents: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: actions/setup-dotnet@v4
         with:
           global-json-file: global.json
@@ -52,7 +52,7 @@ jobs:
     container:
       image: semgrep/semgrep
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Scan
         # OWASP + C# rulesets. --error makes any ERROR-severity finding fail the job;
         # a security scanner that only warns is a scanner nobody reads.
@@ -95,7 +95,7 @@ jobs:
     name: Secret scanning
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0   # gitleaks scans history, not just the diff
       - uses: gitleaks/gitleaks-action@v2
@@ -106,7 +106,7 @@ jobs:
     name: "SCA: vulnerable packages"
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: actions/setup-dotnet@v4
         with:
           global-json-file: global.json
@@ -139,7 +139,7 @@ jobs:
     name: IaC scan
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Checkov
         # Skipped cleanly while there are no manifests yet, rather than failing
         # on an empty directory and training everyone to ignore this job.
@@ -163,7 +163,7 @@ jobs:
       contents: read
       issues: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Skip until a sample exists
         id: guard
@@ -240,7 +240,7 @@ jobs:
       contents: read
       security-events: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: The backlog has not grown
         # WHAT THIS EXISTS FOR. `github/codeql-action/analyze` uploads every alert the