Upgrade pinned GitHub Actions as one batch

[ymichael]

Summary

• upgrade all pinned GitHub Actions consistently across workflows and the local composite action
• combine the two GitHub Actions update locations into one directories: entry
• add a wildcard Dependabot group so future action upgrades arrive in one PR

This replaces #1460, #1461, #1462, #1463, #1464, #1465, #1466, and #1467.

SHA verification

All target tags were independently resolved against their upstream repositories:

Action	Tag	Verified commit
actions/checkout	v7.0.1	3d3c42e5aac5ba805825da76410c181273ba90b1
pnpm/action-setup	v6.0.10	0977fd99725f1db4007ccb2928dbb4e90d06cc86
actions/upload-artifact	v7.0.1	043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
actions/setup-node	v7.0.0	820762786026740c76f36085b0efc47a31fe5020
actions/cache	v6.1.0	55cc8345863c7cc4c66a329aec7e433d2d1c52a9

Breaking-change review

• actions/setup-node 4 → 7: safe. v5 moved the action runtime to Node 24 and enabled automatic package-manager caching; v6 limited automatic caching to npm and removed always-auth; v7 removed the dummy NODE_AUTH_TOKEN. The cache consumers explicitly request cache: pnpm. The npm publish job intentionally has no NODE_AUTH_TOKEN, grants id-token: write, runs on a GitHub-hosted runner with Node 24, and upgrades npm to at least 11.5.1, so removing the dummy value preserves the trusted-publishing OIDC path. publish-bb-app.yml was not dispatched because its scheduled path performs a real publication.
• actions/checkout 4 → 7: safe. v5's Node 24 runtime requirement is satisfied by the GitHub-hosted runners. v6 moved persisted credentials out of the repository into runner temp, but persist-credentials remains enabled and the workflows do not inspect the old storage location. The defaults used here—no submodules and shallow fetch—remain compatible. v7's fork-PR guard does not affect these workflow triggers.
• actions/cache 4 → 6: safe. The starting v4.3.0 already used the cache service v2 migration. v5 moved to Node 24; v6 moved action internals to ESM; v6.1 improves read-only cache handling. Both call sites use explicit keys and ordered restore prefixes, with no dependency on changed internals.
• pnpm/action-setup 4 → 6: safe. v5 moved the action runtime to Node 24 and v6 added pnpm 11 support. Every call site explicitly requests pnpm 9.15.0, matching the root packageManager, and keeps run_install: false, so version inference and install behavior do not change.
• actions/upload-artifact 4 → 7: safe. Both consumers already start on v4.6.2, after v4's immutable artifact and hidden-file changes. Each job performs one upload with its own artifact name, so it does not rely on implicit same-name merging. v5/v6's Node 24 requirement is satisfied; v7's direct-upload behavior is opt-in through archive: false, which is not used.

The intended merge order is therefore one atomic merge of this PR; there are no held upgrades or version twins left split across PRs.

Validation

• pnpm exec prettier --check .github/dependabot.yml .github/actions/setup-workspace/action.yml .github/workflows/*.yml
• Dependabot YAML parse and structural assertions for one update entry, both directories, and the * group
• pnpm exec turbo run build typecheck lint --cache-dir=.turbo/cache --output-logs=new-only
• node apps/app/scripts/check-bundle-budget.mjs
• all server tests: 1,468 passed
• all non-server Turbo test tasks: 54 passed
• pnpm exec turbo run smoke:tarball --filter=bb-app --cache-dir=.turbo/cache --output-logs=new-only

The first all-at-once local test run had one unrelated server test exceed its 15-second timeout under contention; the complete server shard passed when rerun alone. PR CI will exercise ci.yml and version-lockstep.yml. A safe build-desktop.yml branch dispatch will separately exercise the macOS setup and artifact-upload path. The publish, deploy, cache-restore, and credential-cleanup paths can only be fully proven by their native GitHub-hosted runs.

AGENT GENERATED: by GPT-5