build(deps): bump actions/checkout to v7.0.0 and github-script to v9.0.0

[joshua-temple]

Problem

actions/checkout was pinned to v6.0.3 (SHA df4cb1c) and actions/github-script to v7.1.0 (SHA f28e40c). checkout v7 and github-script v9 are Node 24 actions; the Node-24 act image pin from #399 makes these safe to run.

Fix

• internal/generate/action_pins.yaml: checkout v6.0.3 -> v7.0.0 (9c091bb), github-script v7.1.0 -> v9.0.0 (3a2844b)
• Regenerated orchestrate.yaml and promote.yaml (the two cascade-generated workflows)
• Updated all 14 hand-written .github workflows and the composite action to the new SHAs; consistency lint (TestWorkflowsConsistentWithActionPins) is the guard and passes
• Updated e2e scenarios 35/36/39 to assert on v7 SHA/tag instead of v6
• Updated Go unit tests that hardcoded the old SHAs

Verification

Local bar:

• go build ./... clean
• go test ./... 2021 tests pass
• golangci-lint run ./... no issues
• actionlint findings on orchestrate/promote/build-cli are pre-existing on the base branch (same 6 findings, unrelated to this change)
• e2e module builds and vets clean

Docker e2e (act + gitea + Node-24 catthehacker image, actRunnerNodeMajorMin=24):

• TestMultiStepScenarios/Two_Environment_Happy_Path - PASS (act executes the generated orchestrate workflow, checkout v7 runs on Node 24)
• TestMultiStepScenarios/Action_pins:_sha_mode_pins_to_an_immutable_commit (scenario 35) - PASS
• TestMultiStepScenarios/Action_pins:_default_mode_emits_the_mutable_major_tag (scenario 36) - PASS
• TestMultiStepScenarios/Action_pins:_per-action_override_is_honored_over_the_pin_mode (scenario 39) - PASS

5/5 passed. github-script v9 does not appear in any act-executed generated workflow (orchestrate/promote use only checkout); it appears only in the hand-written drift-comment.yaml which does not run under the local harness.

Resolved SHAs (verified via git ls-remote):

• actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 (v7.0.0)
• actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 (v9.0.0)

Bases on refactor/converge-artifact-versions (#401); rebases onto main after that merges.