ops: refresh pinned GitHub Actions for supported runtime

[veraxis-protocol]

Operations-only. No semantic change.

Closes #17 once merged.

What was observed, not assumed

Each pinned SHA was checked against its upstream action.yml:

action	pinned SHA	declared runtime
actions/checkout	fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 (v5.1.0)	node24 — already current, untouched
actions/setup-python	a26af69be951a213d495a4c3e4e4022e16d87065 (v5.6.0)	node20
actions/upload-artifact	330a01c490aca151604b8cf639adc76d48f6c5d4 (v5.0.0)	node20

The two node20 actions are exactly the two named in the deprecation warning
recorded in #17.

Change

action	old SHA / version	new SHA / version
actions/setup-python	a26af69be951a213d495a4c3e4e4022e16d87065 v5.6.0	e797f83bcb11b83ae66e0230d6156d7c80228e7c v6.0.0
actions/upload-artifact	330a01c490aca151604b8cf639adc76d48f6c5d4 v5.0.0	b7c566a772e6b6bfb58ed0dc250532a479d7789f v6.0.0

Each new SHA was resolved from the upstream release tag and its action.yml
confirmed to declare runs.using: node24.

Why v6.0.0 and not the newest release. v6.0.0 is the lowest release of each
action that natively targets node24, so the only intended behavioural change is
the runtime. Both upstream v6.0.0 release notes state the same single breaking
change and the same requirement — Actions runner 2.327.1 or later — which
GitHub-hosted runners satisfy.

Scope

One file changes: .github/workflows/ci.yml, ten lines.

Not modified: STATUS.md, TDD, schemas, semantic contracts, corpus, ZTL
evidence, VEIP evidence, currentness/reliance evidence, claims, RUN evidence.

CI

The seven required contexts run on this PR: bootstrap-integrity,
schema-validation, lint, typecheck, test, sbom, compose-validation. Results are
reported in the checks below; this PR is deliberately left unmerged for owner
review.

🤖 Generated with Claude Code

[inventor1975]

Requesting changes — this PR is now stale and merging it would downgrade the pins it intends to refresh.

The pins it proposes are genuine: I resolved both against upstream tags and they are the real v6.0.0 releases.

actions/setup-python@e797f83b… = v6.0.0 ✓
actions/upload-artifact@b7c566a7… = v6.0.0 ✓

That is not the problem. The problem is that main has moved past them.

Current main (after PR #33 merged):

actions/setup-python@a309ff8b…     # v6.2.0
actions/upload-artifact@043fb46d…  # v7.0.1

This PR proposes:

actions/setup-python@e797f83b…     # v6.0.0
actions/upload-artifact@b7c566a7…  # v6.0.0

So setup-python would go v6.2.0 → v6.0.0 and upload-artifact would go v7.0.1 → v6.0.0. A PR titled "refresh pinned GitHub Actions for supported runtime" would, if merged today, do the opposite of refreshing.

This is not a defect in the PR as authored on 2026-08-17. It is a consequence of it sitting open for nine days while PR #33 advanced the same lines. Worth noting as a process observation rather than a code criticism: a pin-refresh PR has a shelf life, and this repository's own supply-chain discipline is what makes the staleness matter — pinning by digest is exactly the practice that turns an old PR into a silent downgrade rather than a harmless no-op.

Suggested disposition: close as superseded by #33, or rebase onto current main and re-target only pins that are actually behind. If a rebase is preferred, note that checkout and dependency-review-action in main are also already at v6.0.2 and v5.0.0 respectively, so the refresh set may now be empty.

Boundary: I verified the proposed pins against upstream tags and compared them against .github/workflows/ci.yml at current main. I did not run the workflows and did not check whether v7.0.1 of upload-artifact has any behavioural incompatibility that would motivate a deliberate pin-back — if it does, say so and this reads differently.

— Reviewed by Claude (Opus 5) on Vitaly Reznik's standing review authorisation.