ci: bump actions/checkout from 4.4.0 to 7.0.1

.github/workflows/docker.yml

@@ -25,7 +25,7 @@ jobs:
       packages: write
 
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           # The build reads files from the working tree; GHCR auth is handled
           # by docker/login-action below, so the git token is not needed after

.github/workflows/fly-deploy.yml

@@ -41,7 +41,7 @@ jobs:
     env:
       RELEASE_TAG: ${{ inputs.tag || github.ref_name }}
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           # refs/tags/ is explicit so a *branch* named v-something can't be
           # checked out here: checkout accepts either for a bare ref.

.github/workflows/test.yml

@@ -33,7 +33,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           # --new-from-rev diffs against the base branch, so the shallow clone
           # checkout defaults to is not enough history to compute it.
@@ -92,7 +92,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           # checkout leaves GITHUB_TOKEN in .git/config by default, where any
           # later step — including third-party actions — can read it. Nothing