ci: Auto-maintain workflows (pin updates + zizmor security autofixes)

[vc-ci]

Automated maintenance of GitHub Actions workflows:

• Pin updates — pinact run --update bumps third-party action
  SHAs in workflow-templates/. (Dependabot covers pins in
  .github/workflows/.)
• Security autofixes — zizmor --fix=all applies safe and
  unsafe fixes (e.g. template-injection, artipacked,
  ref-version-mismatch) across both .github/workflows/ and
  workflow-templates/, since the reusable workflows here are
  consumed by other repos and the templates are copied into modules.

Warning

--fix=all includes unsafe fixes that require human review.
In particular, check artipacked changes (persist-credentials: false) on any workflow that later pushes with the checkout token,
and verify template-injection rewrites preserve intended values.

---

Note

Low Risk
Routine action pin bumps in CI templates with no application or deployment logic changes; minor risk from upstream action behavior in setup-node major bump.

Overview
Bumps pinned third-party GitHub Actions in workflow-templates/ as part of automated maintenance (pinact).

actions/checkout moves from v7.0.0 → v7.0.1 everywhere it appears: image-deploy.yml, module-deploy.yml, module-ci.yml (version-bump detection + main CI), module-release-hotfix.yml, and publish-nugets.yml.

module-ci.yml also updates actions/setup-node v6.4.0 → v7.0.0 and actions/setup-java v5.5.0 → v5.7.0 for the Node 24 / Java 17 toolchain steps. No workflow steps, inputs, or job structure change—only commit SHAs and version comments.

^{Reviewed by Cursor Bugbot for commit 3fc17d5. Bugbot is set up for automated code reviews on this repo. Configure here.}

[AndrewEhlo]

The same changes already applied by PR #87