chore(deps): bump actions/checkout from 7.0.0 to 7.0.1

[dependabot]

Summary

Dependabot patch update for actions/checkout from 7.0.0 to 7.0.1 across existing CI and release workflows.

Root Cause / Decision Record

• The previous branch was stale and its old CI was blocked by a then-current dependency audit finding.
• The current upstream patch includes checkout hardening; this PR changes only pinned action revisions.
• Current master CI is green; this refreshed branch must pass current checks before merge.

Scope

• Runtime: GitHub Actions workflow action pins only.
• Tests: Existing CI verification only.
• Docs/governance: PR readiness metadata only.
• Explicitly out of scope: extension permissions, portal automation, downloads, storage, and public copy.

Pack Workflow Preflight

• pnpm workflow:preflight is running in the current GitHub Actions validation.
• This Dependabot PR is opened from its bot-owned update branch, not master.
• Latest master Pack AGENTS guidance was reviewed before merge evaluation.
• PR body keeps the required Pack privacy/review/verification checklist visible.

Sanchika Adoption Gate

• This PR does not consume @sanchika/* packages or copied Sanchika guidance.
• This PR does not import parent or Sanchika source paths.

Privacy And Data-Flow Impact

• No new browser permissions, host permissions, network calls, analytics, or telemetry.
• No credential, OTP, CAPTCHA, cookie, token, GST file, or taxpayer-data capture.
• Public copy and privacy declarations are unchanged.

Sensitive Surface Review

• Portal target binding and evidence-backed download completion are unchanged.
• Service-worker durability and side-effect confirmation are unchanged.
• No taxpayer data, local paths, raw URLs/referrers, or portal HTML are in the diff.

Chrome Web Store Impact

• No Chrome Web Store listing scope or full-fiscal-year claim changes.
• CI release evidence remains distinct from store-submission sign-off.
• PR title follows Conventional Commits.

Verification

• Current GitHub Actions: frozen install, dependency audit, WXT prepare, formatting, lint, TypeScript, Vitest, build, and package verification.
• pnpm workflow:preflight and strict current-head review gate before merge.
• git diff --check is covered by current Pack CI.

Artifact Evidence

• CI run: pending on current Dependabot head.
• ZIP artifact: not applicable until CI completes.
• ZIP SHA-256: not applicable until CI completes.
• Clean source/tag or head SHA: bot-owned refreshed head.

PR Review Follow-Up

• GitHub Actions and latest-head automated review are pending.
• Inline review threads will be inspected after checks complete.
• No commits will be added after latest-head review without re-review.

Thread/comment	Disposition	Commit or evidence
Dependabot update	accepted	official v7.0.1 release notes; current CI pending

Screenshots

Not applicable: workflow-pin-only change.

DCO

• Dependabot commit includes a Signed-off-by trailer.

[dependabot]

Labels

The following labels could not be found: ci, dependencies. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[chatgpt-codex-connector]

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Credits must be used to enable repository wide code reviews.

[lamemustafa]

@dependabot rebase

[lamemustafa]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Another round soon, please!

Reviewed commit: 489bcbfaca

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".