ci(deps): update GitHub Actions majors

[paul-cch]

Summary

• Update all seven actions/checkout pins from v4.3.1 to v7.0.0.
• Update all five actions/setup-python pins from v5.6.0 to v6.3.0.
• Record the CI dependency maintenance in the Unreleased changelog.

The workflow keeps immutable commit SHA pins with matching release comments.

Compatibility

Both new action majors use Node 24 and require GitHub Actions runner v2.327.1 or newer:

• actions/checkout v7.0.0: https://github.com/actions/checkout/releases/tag/v7.0.0
• actions/checkout Node 24 runner requirement: https://github.com/actions/checkout/releases/tag/v5.0.0
• actions/setup-python v6.3.0: https://github.com/actions/setup-python/releases/tag/v6.3.0
• actions/setup-python Node 24 runner requirement: https://github.com/actions/setup-python/releases/tag/v6.0.0

Every affected WalBridge job uses ubuntu-latest or macos-latest. The repository has no self-hosted runner configuration or broader runner compatibility promise.

Validation

• Ruby YAML parsing passed.
• go run github.com/rhysd/actionlint/cmd/actionlint@latest .github/workflows/ci.yml passed.
• Fresh Python 3.11 dependency resolution and pip check passed.
• Full unit suite passed, 73 tests.
• CLI flow suite passed, 8 tests.
• Ruff, Bash syntax, and ShellCheck passed.
• Quartz import and display detection passed on macOS.
• Both Swift tools compiled successfully.
• The installer deployed into a temporary home and produced the expected package, binaries, and LaunchAgent files. Local launchctl calls were neutralized to avoid changing the live user session.
• Structured Codex autoreview reported no accepted or actionable findings.

Risk

Low. This changes CI dependencies only. The full pull request matrix will verify the upgraded actions on both GitHub-hosted runner families before merge.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[paul-cch]

Landed as d2d3022aee084f92d5565a2f5b6befedb86b3fa9.

Compatibility proof:

• actions/checkout v7.0.0 and actions/setup-python v6.3.0 both use Node 24 and require runner v2.327.1 or newer.
• All seven WalBridge jobs run on GitHub-hosted ubuntu-latest or macos-latest runners.
• The repository has no self-hosted runner configuration or generic runner compatibility promise.
• The workflow pins the official release commits and keeps matching version comments.

Validation completed before merge:

• YAML syntax: ruby -e 'require "yaml"; YAML.parse_file(".github/workflows/ci.yml")'.
• Actions syntax: go run github.com/rhysd/actionlint/cmd/actionlint@latest .github/workflows/ci.yml.
• Fresh Python 3.11 resolution: python3.11 -m venv <temp>/venv, python -m pip install --upgrade pip ruff, python -m pip install -r requirements.txt, and python -m pip check.
• Full tests: python -m unittest discover -s tests -p 'test_*.py' -v, 73 passed.
• CLI flow tests: python -m unittest discover -s tests -p 'test_main_flow.py' -v, 8 passed.
• Python lint: ruff check --select F configs/wallpaper-colors/wcsync configs/wallpaper-colors/wallpaper_colors.py tests.
• Shell checks: the repository's full bash -n and shellcheck -S error command sets from CI.
• macOS boundary: Quartz imported successfully, display detection returned one display, and both Swift tools compiled with their production frameworks.
• Installer smoke: WTS_INSTALL_HOME=<temp>/install-home bash install.sh deployed the expected Python package, app binaries, and five LaunchAgent files. Local launchctl calls were replaced with /usr/bin/true, so this proof did not alter the live user session.
• Structured autoreview completed with the default Codex reviewer. Result: no accepted or actionable findings.

GitHub proof:

• PR CI passed all seven jobs on the upgraded actions: https://github.com/paul-cch/WalBridge/actions/runs/29375721269
• Exact-head main CI passed all seven jobs, including the unmodified macOS installer and Swift runtime smoke: https://github.com/paul-cch/WalBridge/actions/runs/29375790884
• The old Node 20 deprecation warning is absent from both upgraded-action runs.

Public Model Identifier Gate: PASS. The exact diff, tests, CI logs, PR body, proof comment, and tracked artifacts contained no blocking identifiers or unknown generated artifacts.