chore(deps): bump GitHub Actions to current majors (checkout v7, setup-node v7, pnpm/action-setup v6, Pages)

[devin-ai-integration]

Opened by clean-up-deps
Off stack: workflow-only change; touches no file the dependency stack touches

Summary

• The workflows were several majors behind on the GitHub-maintained actions (most still on Node 20 runtimes). This bumps them to current releases, SHA-pinned with tag comments as before.
• actions/checkout v4 → v7.0.1, pnpm/action-setup v4 → v6.1.0, actions/setup-node v6 → v7.0.0 (check.yml, pages.yml), actions/configure-pages v5 → v6.0.0, actions/upload-pages-artifact v4 → v5.0.0, actions/deploy-pages v4 → v5.0.1.
• Release notes are mechanical for this repo: Node 24 runtimes, checkout persisting credentials to a separate file, checkout v7 blocking fork checkouts on pull_request_target/workflow_run (not used here), new inputs that default off.

Special things to note

• release.yml keeps actions/setup-node v6 on purpose. It sets registry-url without NODE_AUTH_TOKEN; v7 stops exporting the placeholder token v6 set, so the generated .npmrc would reference an unset variable. That workflow only runs on push to main, so this PR can't prove it; tracked in APPS-1714.
• pages.yml also only runs on main: PR CI exercises check.yml only.

Evidence

• vet: pass (all SHAs resolved from the upstream repos; versions past the 7-day release-age gate; no advisories; no new pre/post steps; dist/ diffs scanned, flagged parts read by hand)
• CI on this PR: check.yml

Tracking: APPS-1709

Link to Devin session: https://app.devin.ai/sessions/0b83010262d5455894abfe5da93abc0a
Open in Devin Desktop: https://app.devin.ai/desktop/session/0b83010262d5455894abfe5da93abc0a?variant=devin

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[linear-code]

APPS-1709