ci: bump artifact actions to v7 (upload + download together)

[saadqbal]

Supersedes #329. Dependabot bumped actions/upload-artifact 4→7 but left actions/download-artifact@v4 in release.yml's publish job — a mismatched upload/download major would break the release artifact merge. This bumps all four refs together (3× upload + 1× download). CI/release-only; no CLI change. Closes #329.

🤖 Generated with Claude Code

---

Note

Low Risk
CI/release workflow dependency bumps only; no application or auth logic changes, though release publish depends on artifact compatibility across v7.

Overview
Aligns all GitHub Actions artifact steps on v7 so upload and download stay on the same major version.

actions/upload-artifact moves from @v4 to @v7 in build.yml (matrix binaries), mutation.yml (gremlins report), and release.yml (per-platform dist/). actions/download-artifact in release.yml's publish job is bumped from @v4 to @v7 as well, avoiding a partial Dependabot-style upgrade that could break merge-multiple when aggregating release artifacts.

No workflow logic, paths, or retention settings change—only the action version pins.

^{Reviewed by Cursor Bugbot for commit 47912d3. Bugbot is set up for automated code reviews on this repo. Configure here.}

[LukasWodka]

👋 Heads-up — Code review queue is at 42 / 30

Above the WIP limit. The team convention is to review existing PRs before opening new work.

Open PRs currently in Code review (oldest first):

• averaging-service#183 — docs: SafeTensors deployment-order & resume-safety runbook (epic feat(auth): logout revokes the token server-side (cli#112) #116) · author: @shujaatTracebloc · reviewer: @saadqbal
• averaging-service#184 — test(weights): shared SafeTensors golden-corpus drift guard + declare safetensors dep (SEC-03) · author: @LukasWodka · no reviewer assigned
• averaging-service#185 — test(weights): average a real SafeTensors edge + a legacy edge in one cycle — SEC-03 §8 · author: @LukasWodka · no reviewer assigned
• backend#1093 — chore(deps): bump django from 5.2.14 to 5.2.15 · author: @dependabot · no reviewer assigned
• backend#1119 — perf(api): cache ChoiceGroup + score-formula reference endpoints (#981 item 4, part 1) · author: @aptracebloc · reviewer: @saqlainsyed007
• backend#1121 — chore(release): promote staging → master (week of 2026-07-13) · author: @aptracebloc · reviewer: @saadqbal, @saqlainsyed007
• cli#330 — chore(deps): bump softprops/action-gh-release from 2 to 3 · author: @dependabot · no reviewer assigned
• cli#334 — chore(deps): bump github.com/spf13/cobra from 1.8.1 to 1.10.2 · author: @dependabot · no reviewer assigned
• cli#336 — fix(ci): point Dependabot at develop, not main · author: @saadqbal · no reviewer assigned
• data-ingestors#361 — feat(ingest): emit per-column feature_stats for combine-time normalization (Redesign tb resources: two-line view (secure environment + per-run allocation) #360) · author: @divyasinghds · no reviewer assigned

Pull from review before opening new work. (This is a nudge from the kanban WIP check, not a block.)