ci(deps): update checkout to v7

[steipete]

Summary

• update every workflow from actions/checkout v6 to v7.0.0
• retain the same Node 24 action runtime
• pick up upstream fork-checkout hardening and SHA-256 repository fixes

Verification

• confirmed every checkout usage is pinned to v7.0.0
• actionlint
• GOWORK=off go test -count=1 ./...
• repo-local Codex autoreview: clean
• runtime code unchanged; PR workflows provide checkout execution proof

[clawsweeper]

ClawSweeper status: review started.

I am starting a fresh review of this pull request: ci(deps): update checkout to v7 This is item 1/1 in the current shard. Shard 0/1.

This placeholder means the worker is alive and reading the current context. I will edit this same comment with the actual review when the claws are done clicking.

Crustacean status: shell secured, claws on keyboard, evidence pebbles being sorted.

[steipete]

Landed as 5857f2736f21c035478b58ce3acc0c600eee1e3c.

Verification:

• all 13 workflow checkout usages pinned to v7.0.0; no v6 references remain
• actionlint and GOWORK=off go test -count=1 ./... passed
• repo-local Codex autoreview returned no actionable findings
• exact head d1f788e8cf6efdf3bb1dac7b833decaca9914690: checkout v7 executed successfully across CI, CodeQL, Docker, dependency validation, release snapshot, and secret-scan workflows; Socket checks also passed: https://github.com/openclaw/discrawl/actions/runs/27821086812
• runtime code unchanged; no archive/provider live boundary applied

Caveat: scheduled, Pages, release, and Crabbox-only events did not execute on this PR; they use the same checkout action/runtime proven by the PR workflows.