- actions/checkout: v5 -> v7 (ci.yml, push-winget.yml)
- dorny/paths-filter: v3 -> v4 (ci.yml)
- actions/setup-dotnet: v5 -> v6 (ci.yml)
- actions/upload-artifact: v5 -> v7 (ci.yml, matrix legs + docs artifact)
- actions/download-artifact: v5 -> v8 (ci.yml, docs source by name)
- actions/setup-python: v6 -> v7 (ci.yml)

softprops/action-gh-release was already v3, actions/create-github-app-token
was already v3, actions/upload-pages-artifact and actions/deploy-pages
were already v5 (all current majors) - left unchanged.

No workflow adaptation was needed: upload-artifact names stay unique per
matrix leg, the docs-source download is by name (unaffected by the v5
download-artifact path-nesting change, which only applies to
single-artifact-by-ID downloads), default persist-credentials still lets
the tag push after checkout succeed, and setup-python does not use the
removed pip-install input.

Only .github/workflows files were touched; pre-existing unrelated
modifications to *.csproj files in this working tree were left as-is per
instructions to change nothing except workflow YAML.