[chore] : bump actions to the current major and pin every action to a commit SHA

[suhailopensource]

Every CI run currently carries this annotation (verbatim, from the latest run):

Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run
on Node.js 24: actions/checkout@v4, actions/setup-node@v4

Separately, all of our actions are referenced by floating tag. There are 12 uses: lines —
9 in .github/workflows/ci.yml, 3 in .github/workflows/publish.yml. A floating tag can be
repointed by whoever owns the action, and publish.yml holds id-token: write and publishes to
npm via OIDC trusted publishing, so a moved tag there reaches our release credentials.

What to do

1. Bump actions/checkout and actions/setup-node to the current major. As of 2026-08-19 that
   is checkout@v7.0.1 and setup-node@v7.0.0 — re-check at PR time, don't take these as
   gospel.

2. Pin every action to a full 40-character commit SHA with a trailing version comment:

   - uses: actions/checkout@<sha>  # v7.0.1
   

   This applies to all 12, including oven-sh/setup-bun@v2, denoland/setup-deno@v2, and
   softprops/action-gh-release@v2.

Acceptance criteria

• A CI run on the PR shows no Node.js deprecation annotations.
• Every uses: in both workflows is a 40-char SHA with a # vX.Y.Z comment.
• All 7 CI jobs stay green (Node 18/20/22/24, legacy 14.18/16, runtimes).
• publish.yml is not otherwise modified — no permission, trigger, or step changes.

Note: pinning to SHAs means updates stop arriving via tags. Dependabot's github-actions
ecosystem understands SHA pins and will raise bump PRs with the comment updated, so this pairs
naturally with adding .github/dependabot.yml — happy to see that in the same PR or a separate one.

[Nityam43]

Hi @suhailopensource, this is ready for your review!

I've made sure to pin all the actions to their exact 40-character real-world SHAs and included the dependabot.yml configuration so they stay up to date automatically. Let me know if you need any tweaks!

[suhailopensource]

@Nityam43 Thanks For the PR. Ill review it shortly . Do star the repo.