chore(deps): consolidate safe automation updates

[ty-everett]

Summary

• adopt the compatible GitHub Actions updates from Dependabot PR chore(deps): Bump the "monthly-stack-maintenance" group with 4 updates across multiple ecosystems #343 using immutable SHAs and accurate release-version comments
• extend the TypeScript-major hold to all eight standalone infrastructure npm scopes, fixing the policy gap that allowed TypeScript 7 to recur
• keep Node container majors and MySQL/MongoDB deployment majors out of routine monthly PRs until their coordinated runtime/data migration plans pass
• document the monthly automation boundary and enforce it in repository-health tests
• update the container supply-chain assertion to the reviewed docker/build-push-action v7.3.0 commit

This supersedes the mergeable portion of #343. The bot PR itself is intentionally not merged: TypeScript 7 conflicts with ts-jest's <7 peer range and fails three infrastructure installs; Node 26 diverges from the owned Node 24 build/runtime baseline and fails the container registry/evidence contract; MongoDB 8 and MySQL 9 require explicit upgrade, backup/restore, compatibility, and rollback validation.

Action updates

• actions/checkout 6.0.2 → 7.0.1
• actions/setup-node 6 → 7.0.0
• actions/setup-go 6.4.0 → 7.0.0
• pnpm/action-setup 6 → 6.0.9
• codecov/codecov-action 6.0.1 → 7.0.0
• SonarSource/sonarqube-scan-action 8.1.0 → 8.2.1
• docker/login-action 4.2.0 → 4.5.1
• docker/setup-buildx-action 4.1.0 → 4.2.0
• refresh the pinned docker/build-push-action 7.3.0 commit
• aws-actions/configure-aws-credentials 6.2.0 → 6.2.3

The Dependabot-generated workflow itself exercised the new checkout/setup/pnpm/action runtime successfully; this PR runs the complete repository matrix again without the incompatible compiler/runtime/database changes.

Validation

• node --test scripts/*.test.mjs — 20/20
• pnpm health:check — 37 projects, 30 public packages, 148 ratcheted findings, 11 owned exceptions, 0 control errors
• YAML parse of Dependabot and every workflow — pass
• pnpm --filter docs-site validate — 94 frontmatter and link checks
• pnpm --filter docs-site build — 94 routes prerendered, 99 built HTML links checked
• pnpm check-versions — pass
• pnpm audit:security — no known vulnerabilities
• git diff --check — pass

Tracks #324. No package versions are changed or published here, and no service CORS/CSP behavior is changed.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[ty-everett]

Maintainer approval-in-substance (ty-everett): I reviewed the complete dependency-policy diff and all review feedback. Every required CI, test, coverage, CodeQL, dependency-review, Socket, infrastructure, repository-health, docs, and Sonar check is green, including 0 new Sonar issues and 0 security hotspots. The change intentionally admits patch/minor automation while holding breaking TypeScript, Node, MySQL, and MongoDB majors for explicit migration PRs. GitHub does not permit an author to submit a formal approval review, so this records the required maintainer review before an admin merge.