build: bump actions/checkout from 5.1.0 to 7.0.1 in the github-actions group

[dependabot]

No related issue: Dependabot grouped GitHub Actions bump; no tracking issue exists for this pin.

Summary

Bumps the four actions/checkout pins in .github/workflows/ci.yml from v5.1.0 to v7.0.1 so they match the SHA already running in managed-files-guard.yml. v7's breaking change only restricts fork-PR checkout on pull_request_target and workflow_run; this repository uses neither.

Fix

• Replace the four actions/checkout SHAs in ci.yml with 3d3c42e5aac5ba805825da76410c181273ba90b1 (v7.0.1) and retitle the pin comments to match.
• Merge main so the bump does not regress the ci-status v0.22.2 pin from ci: re-pin ci-status to ci-workflows v0.22.2 #34.
• Drop the non-existent github_actions label from dependabot.yml. The org label roster is managed by github-iac; Dependabot failed to apply that label on this PR.

Verification

• git ls-remote https://github.com/actions/checkout.git refs/tags/v7.0.1 resolves to 3d3c42e5aac5ba805825da76410c181273ba90b1.
• Neither .github/workflows/ci.yml nor .github/workflows/managed-files-guard.yml uses pull_request_target or workflow_run.
• managed-files-guard.yml is already on this SHA and passing on main.
• CI ci-status on this PR must be green before merge.

Related

• Refs Lane telemetry: babysit-loop #32 (babysit-loop diagnosis of the v5→v7 bump and the duplicate ci-status race)
• Upstream: https://github.com/actions/checkout/releases/tag/v7.0.1

[dependabot]

Labels

The following labels could not be found: github_actions. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[github-actions]

PR body contract — issue linkage

This PR body conforms to the issue-linkage contract. Nothing to do.

[kyle-sexton]

Lane claim — babysit-loop (instance ccr-session-babysit-loop-20260905)

Claiming this PR for read-only readiness diagnosis. Pinned head SHA: 5bd185d3134ed657358af77bbba8233adc96f191. Lease expires 2026-09-06T07:51:13Z.

No merge will be attempted from this lane: this is a dependency-manager-authored PR and a major-version bump, both of which require an explicit human decision. Claim released on completion.

---

Generated by Claude Code

[kyle-sexton]

Lane released — babysit-loop (instance ccr-session-babysit-loop-20260905)

Read-only diagnosis complete on head SHA 5bd185d3134ed657358af77bbba8233adc96f191. No merge attempted. Full write-up: #32.

Summary for the reviewer:

• ⚠️ Major-version bump (v5 → v7) of actions/checkout, carrying an upstream breaking change to default fork-PR checkout. Needs an explicit human dependency-acceptance decision. Assessed blast radius on this repo is currently nil: neither ci.yml nor managed-files-guard.yml uses pull_request_target or workflow_run, the only triggers v7 restricts. Note managed-files-guard.yml is already pinned to this exact v7.0.1 SHA and passing, so v7 is already running green here.
• ✅ All substantive lanes pass. Combined status is ci-lanes: success — All lanes passed. PR is mergeable: true, signature verified, no unresolved threads, zero required approvals.
• ℹ️ needs-issue-linkage is advisory here, not a gate. The ci-gate ruleset requires only the ci-status context; the CI log confirms the linkage step does not fail the build.
• 🔧 mergeable_state: blocked is a CI race, not a real failure. Two runs were created on this SHA in the same second: full run build: bump the github-actions group with 3 updates #44 (green) and contract-only run #45, which fail-closed looking for the ci-lanes status ~37s before build: bump the github-actions group with 3 updates #44 wrote it. Both ci-status check runs survive filter=latest, leaving the required context ambiguous. Re-running run #45 should clear it — the status it needed now exists on the SHA, and no new commit is required.
• 📝 If this bump is accepted: the four # actions/checkout v5.1.0 … comments in ci.yml are now stale and sit directly above a v7.0.1 SHA. They should be corrected in the same PR.

Holding for the human's dependency call.

---

Generated by Claude Code

[cursor]

Proceeding to merge this Dependabot bump: the user asked to drive unmerged PRs to mergeable and merge them when ready, which is the explicit dependency-acceptance call the earlier babysit-loop diagnosis was waiting on.

v7 blast radius on this repo is still nil (ci.yml and managed-files-guard.yml do not use pull_request_target or workflow_run; managed-files-guard.yml is already on this SHA). Follow-ups on this branch:

• Merged main so the bump does not regress the ci-status v0.22.2 pin from ci: re-pin ci-status to ci-workflows v0.22.2 #34.
• Retitled the four ci.yml pin comments from v5.1.0 to v7.0.1.
• Dropped the non-existent github_actions label from dependabot.yml (org roster is github-iac; Dependabot could not apply it).
• Filled the PR body contract (No related issue: plus Summary / Fix / Verification / Related).

Will squash-merge once ci-status is green on the new head.