chore(ci): bump pinned actions to current majors

[thewrz]

This was written agentically; verify its assertions:

Why

Renovate (#129, #144) and dependabot (#138, #139) all proposed the same GitHub Actions bumps, but every one of those branches is based on pins that #143 already replaced, so they conflict with main and cannot rebase without a bot cycle. One fresh PR lands the same pins.

What

Action	From → To
actions/checkout	v6.1.0 → v7.0.1
actions/setup-node	v6.5.0 → v7.0.0
actions/dependency-review-action	v4.9.0 → v5.0.0
github/codeql-action	v3 → v4.38.0
softprops/action-gh-release	v3.0.2 → v3.0.3

All remain full-commit SHA pins with a version comment. The majors are node24 runtime moves with no input changes for the inputs this repo uses. SHAs come from the GitHub API tag objects and match renovate's proposal in #129 for checkout and setup-node.

Supersedes #129, #144, #138 and #139, which are closed as outdated.

Testing

• YAML parses; zizmor findings byte-identical before/after (all pre-existing)
• CI green on this PR (typecheck, test, audit, node-pin, CodeQL v4, dependency-review v5)

🤖 Co-authored by Claude Fable 5.1.
🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: d6b51d58-c4b3-4eb0-8fd5-8cce12216737

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[thewrz]

This was written agentically; verify its assertions:

Adversarial review receipt

• Reviewer: provider=codex; model=gpt-5.6-sol; effort=xhigh; mode=cross-provider (reason: n/a)
• Counts: P1=0; P2=0; total=0
• Reviewed head: 021d022
• Confirmed finding: none confirmed
• Verified-skip rationale: Verified immutable SHA refresh of already-pinned GitHub Actions; no workflow logic, inputs, permissions, or triggers change. Mechanically verifiable against the registry, and the user-specified verification standard for this triage is smoke tests plus local CI.; mechanical oracle=Every changed line is a uses: pin; each new SHA equals the commit the named release tag dereferences to via the GitHub API (git/ref/tags -> git/tags), and matches renovate's chore(ci): Update github-actions (major) #129 for checkout and setup-node; YAML parses; zizmor output is byte-identical before and after (33 findings, all pre-existing); the PR's own CI runs on the new pins.

🤖 Co-authored by Claude Fable 5.1.

[thewrz]

This was written agentically; verify its assertions:

Review ledger

Machine-readable record of every review already performed on this PR.

{
  "version": 1,
  "pr": 154,
  "repo": "wrzonance/DMXr",
  "reviews": [
    {
      "kind": "adversarial",
      "provider": "codex",
      "model": "gpt-5.6-sol",
      "effort": "xhigh",
      "mode": "cross-provider",
      "harness": "claude",
      "head_sha": "021d0223db8135f086255e25c688b1687ad1208d",
      "covered_heads": [
        "021d0223db8135f086255e25c688b1687ad1208d",
        "0a2838ba342ad331ef14491be459411e771903b8"
      ],
      "counts": {
        "p1": 0,
        "p2": 0
      },
      "reviewed_at": "2026-09-15T17:26:27Z",
      "coverage": [
        {
          "sha": "0a2838ba342ad331ef14491be459411e771903b8",
          "reason": "merge-down:364d4be628dcbfc26b42e172f9fe3e86e32179e2",
          "covered_at": "2026-09-15T17:30:29Z"
        }
      ]
    }
  ]
}

🤖 Co-authored by Claude Fable 5.1.