chore(ci): bump actions/checkout v6 -> v7 across reusable workflows

actions/checkout v7.0.0 (2026-06-18) is internally an ESM rebuild plus
one behavioral change: it blocks checking out a fork PR head ref under
pull_request_target / workflow_run (PR #2454). No Sea Haven workflow uses
those triggers, so there is no reachable behavior change. The Node 24
runtime requirement already landed at v6, so v6 -> v7 carries no new
runner requirement. All runners here are GitHub-hosted (ubuntu, macos).

Covers all 16 checkout pins across 12 reusable/standalone workflows plus
the dependency-review workflow-template scaffold. Consumers on @main pick
this up automatically on merge.

.github/workflows/callable-dependency-review.yaml

@@ -7,7 +7,7 @@ jobs:
   dependency-review:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: actions/dependency-review-action@v5
         with:
           fail-on-severity: high

.github/workflows/cd-cdk.yaml

@@ -53,7 +53,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: docker/setup-qemu-action@v4
         if: ${{ inputs.enable-qemu }}

.github/workflows/cd-mobile-ios.yaml

@@ -60,7 +60,7 @@ jobs:
       run:
         working-directory: ${{ inputs.working-directory }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: aws-actions/configure-aws-credentials@v6
         with:

.github/workflows/cd-sam.yaml

@@ -40,7 +40,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-python@v6
         with:

.github/workflows/ci-dotnet.yaml

@@ -31,7 +31,7 @@ jobs:
       run:
         working-directory: ${{ inputs.working-directory }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-dotnet@v5
         with:

.github/workflows/ci-python-app.yaml

@@ -51,7 +51,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-python@v6
         with:
@@ -97,7 +97,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-python@v6
         with:
@@ -118,7 +118,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-python@v6
         with:

.github/workflows/ci-python-sam.yaml

@@ -52,7 +52,7 @@ jobs:
       group: ci-python-sam-${{ github.workflow }}-${{ github.ref }}-${{ inputs.source-dirs }}
       cancel-in-progress: true
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-python@v6
         with:

.github/workflows/ci-static.yaml

@@ -70,7 +70,7 @@ jobs:
       CHECK_DIR: ${{ inputs.check-dir }}
       BUILD_COMMAND: ${{ inputs.build-command }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-node@v6
         if: ${{ inputs.run-htmlhint || inputs.build-command != '' }}

.github/workflows/ci-typescript-cdk.yaml

@@ -64,7 +64,7 @@ jobs:
       group: ci-typescript-cdk-${{ github.workflow }}-${{ github.ref }}-${{ inputs.working-directory }}
       cancel-in-progress: true
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: docker/setup-qemu-action@v4
         if: ${{ inputs.enable-qemu }}

.github/workflows/ci-typescript-frontend.yaml

@@ -87,7 +87,7 @@ jobs:
       run:
         working-directory: ${{ inputs.working-directory }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 

.github/workflows/ci.yaml

@@ -42,7 +42,7 @@ jobs:
     name: ci / ci
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Install actionlint
         env:

.github/workflows/compliance-audit.yaml

@@ -62,13 +62,13 @@ jobs:
           repositories: ${{ matrix.repo }},engineering-handbook
 
       - name: Checkout repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           repository: Sea-Haven-Industries/${{ matrix.repo }}
           token: ${{ steps.app-token.outputs.token }}
 
       - name: Checkout engineering handbook
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           repository: Sea-Haven-Industries/engineering-handbook
           token: ${{ steps.app-token.outputs.token }}

workflow-templates/dependency-review.yml

@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
       - name: Dependency Review
         uses: actions/dependency-review-action@v4
         with: