Release v4.24.6

What's Changed

• feat(actions): granular actions, scan scopes and lock-safe releases by @0x73746F66 in #192
• ci: adopt the granular actions in cli, under a lock file by @0x73746F66 in #196
• ci(vulnetix): release.yml owns the TEA publish in this repository by @0x73746F66 in #198
• chore(actions): weekly union check; retire tea-release.yml and the old docs generation by @0x73746F66 in #199
• test(actions): step one pin back to exercise the Dependabot path by @0x73746F66 in #200
• fix(ci): the pins job no longer spends the workflow token's quota by @0x73746F66 in #202
• fix(ci): the pins job pushes with its own token by @0x73746F66 in #203
• fix(ci): the pins job keys on who opened the pull request by @0x73746F66 in #204
• fix(ci): lock verification does not depend on the workflow token's quota by @0x73746F66 in #205
• build(deps): bump sigstore/cosign-installer from 4.1.1 to 4.1.2 in /tools/actiongen/pins by @dependabot[bot] in #201
• ci(vulnetix): a job that runs the setup action itself by @0x73746F66 in #206
• feat(actions): config-apply can apply only a reviewed plan by @0x73746F66 in #207
• fix: findings from an independent review of the admin-merged changes by @0x73746F66 in #208
• fix(gha-init): download the TEA BOM artifacts with the bare glob by @0x73746F66 in #210
• fix(execguard): answer the workload's own exec once and stop reading the listener when the run ends by @0x73746F66 in #212
• ci(vulnetix): adopt the granular actions and lock the workflows by @0x73746F66 in #209

Full Changelog: v4.22.3...v4.24.6