build(deps): Bump actions/checkout from 6 to 7

.github/workflows/glyphcheck.yml

@@ -34,7 +34,7 @@ jobs:
   glyphcheck:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: actions/setup-go@v6
         with: { go-version: "${{ env.GO_VERSION }}" }
       - name: linter self-test (stdlib only, offline)

.github/workflows/kit-autobump.yml

@@ -23,7 +23,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       # Bot token so the PR triggers validate.yml (which gates auto-merge).
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           token: ${{ secrets.KIT_RELEASE_TOKEN }}
       - uses: actions/setup-go@v6

.github/workflows/publish.yml

@@ -39,7 +39,7 @@ jobs:
       # outputs the arcade re-verifies server-side anyway).
       dirs: ${{ steps.changed.outputs.dirs }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0             # full history for the changed-dirs diff
           persist-credentials: false # this job compiles untrusted code — no token on disk
@@ -183,7 +183,7 @@ jobs:
       contents: write       # cut releases
       pull-requests: write  # upsert the verified:false comment on the merged PR
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0             # all tags for N derivation + CHANGELOG notes
           persist-credentials: false # gh uses GH_TOKEN from env; git stays read-only

.github/workflows/validate.yml

@@ -22,7 +22,7 @@ jobs:
   submissions:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with: { fetch-depth: 0 }
 
       - name: changed game dirs

.github/workflows/vulncheck.yml

@@ -38,7 +38,7 @@ jobs:
   go-games:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: actions/setup-go@v6
         with: { go-version: "${{ env.GO_VERSION }}" }
       - name: govulncheck every Go game
@@ -59,7 +59,7 @@ jobs:
   rust-games:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: cargo-audit every Rust game
         run: |
           cargo install cargo-audit --locked --version "${CARGO_AUDIT_VERSION}"