chore(deps): bump the actions group with 3 updates (#270)

Bumps the actions group with 3 updates:
[actions/checkout](https://github.com/actions/checkout),
[taiki-e/install-action](https://github.com/taiki-e/install-action) and
[hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml](https://github.com/hyperpolymath/panic-attack).

Updates `actions/checkout` from 6.0.3 to 7.0.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/checkout/releases">actions/checkout's
releases</a>.</em></p>
<blockquote>
<h2>v7.0.0</h2>
<h2>What's Changed</h2>
<ul>
<li>block checking out fork pr for pull_request_target and workflow_run
by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li>
<li>Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the
minor-actions-dependencies group across 1 directory by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/actions/checkout/pull/2458">actions/checkout#2458</a></li>
<li>Bump flatted from 3.3.1 to 3.4.2 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/actions/checkout/pull/2460">actions/checkout#2460</a></li>
<li>Bump js-yaml from 4.1.0 to 4.2.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/actions/checkout/pull/2461">actions/checkout#2461</a></li>
<li>Bump <code>@​actions/core</code> and
<code>@​actions/tool-cache</code> and Remove uuid by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/actions/checkout/pull/2459">actions/checkout#2459</a></li>
<li>upgrade module to esm and update dependencies by <a
href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2463">actions/checkout#2463</a></li>
<li>Bump the minor-npm-dependencies group across 1 directory with 3
updates by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/actions/checkout/pull/2462">actions/checkout#2462</a></li>
<li>getting ready for checkout v7 release by <a
href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2464">actions/checkout#2464</a></li>
<li>update error wording by <a
href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2467">actions/checkout#2467</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> made
their first contribution in <a
href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/checkout/compare/v6.0.3...v7.0.0">https://github.com/actions/checkout/compare/v6.0.3...v7.0.0</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/actions/checkout/blob/main/CHANGELOG.md">actions/checkout's
changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<h2>v7.0.0</h2>
<ul>
<li>Block checking out fork PR for pull_request_target and workflow_run
by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li>
<li>Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the
minor-actions-dependencies group across 1 directory by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/actions/checkout/pull/2458">actions/checkout#2458</a></li>
<li>Bump flatted from 3.3.1 to 3.4.2 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/actions/checkout/pull/2460">actions/checkout#2460</a></li>
<li>Bump js-yaml from 4.1.0 to 4.2.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/actions/checkout/pull/2461">actions/checkout#2461</a></li>
<li>Bump <code>@​actions/core</code> and
<code>@​actions/tool-cache</code> and Remove uuid by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/actions/checkout/pull/2459">actions/checkout#2459</a></li>
<li>upgrade module to esm and update dependencies by <a
href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2463">actions/checkout#2463</a></li>
<li>Bump the minor-npm-dependencies group across 1 directory with 3
updates by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/actions/checkout/pull/2462">actions/checkout#2462</a></li>
</ul>
<h2>v6.0.3</h2>
<ul>
<li>Fix checkout init for SHA-256 repositories by <a
href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2439">actions/checkout#2439</a></li>
<li>fix: expand merge commit SHA regex and add SHA-256 test cases by <a
href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li>
</ul>
<h2>v6.0.2</h2>
<ul>
<li>Fix tag handling: preserve annotations and explicit fetch-tags by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2356">actions/checkout#2356</a></li>
</ul>
<h2>v6.0.1</h2>
<ul>
<li>Add worktree support for persist-credentials includeIf by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2327">actions/checkout#2327</a></li>
</ul>
<h2>v6.0.0</h2>
<ul>
<li>Persist creds to a separate file by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2286">actions/checkout#2286</a></li>
<li>Update README to include Node.js 24 support details and requirements
by <a href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a>
in <a
href="https://redirect.github.com/actions/checkout/pull/2248">actions/checkout#2248</a></li>
</ul>
<h2>v5.0.1</h2>
<ul>
<li>Port v6 cleanup to v5 by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2301">actions/checkout#2301</a></li>
</ul>
<h2>v5.0.0</h2>
<ul>
<li>Update actions checkout to use node 24 by <a
href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2226">actions/checkout#2226</a></li>
</ul>
<h2>v4.3.1</h2>
<ul>
<li>Port v6 cleanup to v4 by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2305">actions/checkout#2305</a></li>
</ul>
<h2>v4.3.0</h2>
<ul>
<li>docs: update README.md by <a
href="https://github.com/motss"><code>@​motss</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1971">actions/checkout#1971</a></li>
<li>Add internal repos for checking out multiple repositories by <a
href="https://github.com/mouismail"><code>@​mouismail</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1977">actions/checkout#1977</a></li>
<li>Documentation update - add recommended permissions to Readme by <a
href="https://github.com/benwells"><code>@​benwells</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2043">actions/checkout#2043</a></li>
<li>Adjust positioning of user email note and permissions heading by <a
href="https://github.com/joshmgross"><code>@​joshmgross</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2044">actions/checkout#2044</a></li>
<li>Update README.md by <a
href="https://github.com/nebuk89"><code>@​nebuk89</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2194">actions/checkout#2194</a></li>
<li>Update CODEOWNERS for actions by <a
href="https://github.com/TingluoHuang"><code>@​TingluoHuang</code></a>
in <a
href="https://redirect.github.com/actions/checkout/pull/2224">actions/checkout#2224</a></li>
<li>Update package dependencies by <a
href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2236">actions/checkout#2236</a></li>
</ul>
<h2>v4.2.2</h2>
<ul>
<li><code>url-helper.ts</code> now leverages well-known environment
variables by <a href="https://github.com/jww3"><code>@​jww3</code></a>
in <a
href="https://redirect.github.com/actions/checkout/pull/1941">actions/checkout#1941</a></li>
<li>Expand unit test coverage for <code>isGhes</code> by <a
href="https://github.com/jww3"><code>@​jww3</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1946">actions/checkout#1946</a></li>
</ul>
<h2>v4.2.1</h2>
<ul>
<li>Check out other refs/* by commit if provided, fall back to ref by <a
href="https://github.com/orhantoy"><code>@​orhantoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1924">actions/checkout#1924</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/checkout/commit/9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0"><code>9c091bb</code></a>
update error wording (<a
href="https://redirect.github.com/actions/checkout/issues/2467">#2467</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/1044a6dea927916f2c38ba5aeffbc0a847b1221a"><code>1044a6d</code></a>
getting ready for checkout v7 release (<a
href="https://redirect.github.com/actions/checkout/issues/2464">#2464</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/f0282184c7ce73ab54c7e4ab5a617122602e575f"><code>f028218</code></a>
Bump the minor-npm-dependencies group across 1 directory with 3 updates
(<a
href="https://redirect.github.com/actions/checkout/issues/2462">#2462</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/d914b262ffc244530a203ab40decab34c3abf34d"><code>d914b26</code></a>
upgrade module to esm and update dependencies (<a
href="https://redirect.github.com/actions/checkout/issues/2463">#2463</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/537c7ef99cef6e5ddb5e7ff5d16d14510503801d"><code>537c7ef</code></a>
Bump <code>@​actions/core</code> and <code>@​actions/tool-cache</code>
and Remove uuid (<a
href="https://redirect.github.com/actions/checkout/issues/2459">#2459</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/130a169078a413d3a5246a393625e8e742f387f6"><code>130a169</code></a>
Bump js-yaml from 4.1.0 to 4.2.0 (<a
href="https://redirect.github.com/actions/checkout/issues/2461">#2461</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/7d09575332117a40b46e5e020664df234cd416f3"><code>7d09575</code></a>
Bump flatted from 3.3.1 to 3.4.2 (<a
href="https://redirect.github.com/actions/checkout/issues/2460">#2460</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/0f9f3aa320cb53abeb534aeb54048075d9697a0e"><code>0f9f3aa</code></a>
Bump actions/publish-immutable-action (<a
href="https://redirect.github.com/actions/checkout/issues/2458">#2458</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/f9e715a95fcd1f9253f77dd28f11e88d2d6460c7"><code>f9e715a</code></a>
block checking out fork pr for pull_request_target and workflow_run (<a
href="https://redirect.github.com/actions/checkout/issues/2454">#2454</a>)</li>
<li>See full diff in <a
href="https://github.com/actions/checkout/compare/df4cb1c069e1874edd31b4311f1884172cec0e10...9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0">compare
view</a></li>
</ul>
</details>
<br />

Updates `taiki-e/install-action` from 2.81.5 to 2.82.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/taiki-e/install-action/releases">taiki-e/install-action's
releases</a>.</em></p>
<blockquote>
<h2>2.82.0</h2>
<ul>
<li>
<p>Support <code>cargo-vet</code>. (<a
href="https://redirect.github.com/taiki-e/install-action/pull/1908">#1908</a>,
thanks <a
href="https://github.com/jakewimmer"><code>@​jakewimmer</code></a>)</p>
</li>
<li>
<p>Support <code>cargo-crap</code>. (<a
href="https://redirect.github.com/taiki-e/install-action/pull/1905">#1905</a>,
thanks <a
href="https://github.com/BartoszCiesla"><code>@​BartoszCiesla</code></a>)</p>
</li>
<li>
<p>Support <code>cargo-leptos</code>. (<a
href="https://redirect.github.com/taiki-e/install-action/pull/1903">#1903</a>,
thanks <a
href="https://github.com/404Simon"><code>@​404Simon</code></a>)</p>
</li>
<li>
<p>Update <code>kingfisher@latest</code> to 1.103.0.</p>
</li>
<li>
<p>Update <code>cargo-xwin@latest</code> to 0.23.0.</p>
</li>
<li>
<p>Update <code>wasmtime@latest</code> to 45.0.2.</p>
</li>
<li>
<p>Update <code>cargo-deny@latest</code> to 0.19.9.</p>
</li>
<li>
<p>Update <code>prek@latest</code> to 0.4.5.</p>
</li>
<li>
<p>Update <code>trivy@latest</code> to 0.71.1.</p>
</li>
<li>
<p>Update <code>mise@latest</code> to 2026.6.10.</p>
</li>
</ul>
<h2>2.81.11</h2>
<ul>
<li>
<p>Update <code>wasm-tools@latest</code> to 1.252.0.</p>
</li>
<li>
<p>Update <code>wasm-bindgen@latest</code> to 0.2.125.</p>
</li>
<li>
<p>Update <code>uv@latest</code> to 0.11.21.</p>
</li>
<li>
<p>Update <code>protoc@latest</code> to 3.35.1.</p>
</li>
<li>
<p>Update <code>mise@latest</code> to 2026.6.9.</p>
</li>
<li>
<p>Update <code>jaq@latest</code> to 3.1.0.</p>
</li>
<li>
<p>Update <code>cargo-insta@latest</code> to 1.48.0.</p>
</li>
<li>
<p>Update <code>biome@latest</code> to 2.5.0.</p>
</li>
</ul>
<h2>2.81.10</h2>
<ul>
<li>
<p>Update <code>tombi@latest</code> to 1.1.3.</p>
</li>
<li>
<p>Update <code>release-plz@latest</code> to 0.3.159.</p>
</li>
<li>
<p>Update <code>cosign@latest</code> to 3.1.1.</p>
</li>
</ul>
<h2>2.81.9</h2>
<ul>
<li>
<p>Update <code>wasm-bindgen@latest</code> to 0.2.123.</p>
</li>
<li>
<p>Update <code>tombi@latest</code> to 1.1.2.</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md">taiki-e/install-action's
changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<p>All notable changes to this project will be documented in this
file.</p>
<p>This project adheres to <a href="https://semver.org">Semantic
Versioning</a>.</p>
<!-- raw HTML omitted -->
<h2>[Unreleased]</h2>
<h2>[2.82.0] - 2026-06-17</h2>
<ul>
<li>
<p>Support <code>cargo-vet</code>. (<a
href="https://redirect.github.com/taiki-e/install-action/pull/1908">#1908</a>,
thanks <a
href="https://github.com/jakewimmer"><code>@​jakewimmer</code></a>)</p>
</li>
<li>
<p>Support <code>cargo-crap</code>. (<a
href="https://redirect.github.com/taiki-e/install-action/pull/1905">#1905</a>,
thanks <a
href="https://github.com/BartoszCiesla"><code>@​BartoszCiesla</code></a>)</p>
</li>
<li>
<p>Support <code>cargo-leptos</code>. (<a
href="https://redirect.github.com/taiki-e/install-action/pull/1903">#1903</a>,
thanks <a
href="https://github.com/404Simon"><code>@​404Simon</code></a>)</p>
</li>
<li>
<p>Update <code>kingfisher@latest</code> to 1.103.0.</p>
</li>
<li>
<p>Update <code>cargo-xwin@latest</code> to 0.23.0.</p>
</li>
<li>
<p>Update <code>wasmtime@latest</code> to 45.0.2.</p>
</li>
<li>
<p>Update <code>cargo-deny@latest</code> to 0.19.9.</p>
</li>
<li>
<p>Update <code>prek@latest</code> to 0.4.5.</p>
</li>
<li>
<p>Update <code>trivy@latest</code> to 0.71.1.</p>
</li>
<li>
<p>Update <code>mise@latest</code> to 2026.6.10.</p>
</li>
</ul>
<h2>[2.81.11] - 2026-06-15</h2>
<ul>
<li>
<p>Update <code>wasm-tools@latest</code> to 1.252.0.</p>
</li>
<li>
<p>Update <code>wasm-bindgen@latest</code> to 0.2.125.</p>
</li>
<li>
<p>Update <code>uv@latest</code> to 0.11.21.</p>
</li>
<li>
<p>Update <code>protoc@latest</code> to 3.35.1.</p>
</li>
<li>
<p>Update <code>mise@latest</code> to 2026.6.9.</p>
</li>
<li>
<p>Update <code>jaq@latest</code> to 3.1.0.</p>
</li>
<li>
<p>Update <code>cargo-insta@latest</code> to 1.48.0.</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/taiki-e/install-action/commit/b8cecb83565409bcc297b2df6e77f030b2a468d5"><code>b8cecb8</code></a>
Release 2.82.0</li>
<li><a
href="https://github.com/taiki-e/install-action/commit/981171473775d521e3ae1e0b14c569b51c48651e"><code>9811714</code></a>
Update changelog</li>
<li><a
href="https://github.com/taiki-e/install-action/commit/e7005464717d3cca03b48509ba65ebbde552e10c"><code>e700546</code></a>
Update wasmtime manifest</li>
<li><a
href="https://github.com/taiki-e/install-action/commit/fdfb4a4a7c8af40d72ebb849dac38e8718ea669c"><code>fdfb4a4</code></a>
Update mise manifest</li>
<li><a
href="https://github.com/taiki-e/install-action/commit/ef03904287f8419ca540ee664cc9227c6d501867"><code>ef03904</code></a>
Update martin manifest</li>
<li><a
href="https://github.com/taiki-e/install-action/commit/b6d098313f0ccec3f73270982ba4474205dbd7fd"><code>b6d0983</code></a>
Update <code>kingfisher@latest</code> to 1.103.0</li>
<li><a
href="https://github.com/taiki-e/install-action/commit/ebeb9b1a53c2307773f018dca9868b795675e6c5"><code>ebeb9b1</code></a>
Update just manifest</li>
<li><a
href="https://github.com/taiki-e/install-action/commit/119edcf29d9a2c67fad2ed58e04242daceb433e5"><code>119edcf</code></a>
Update <code>cargo-xwin@latest</code> to 0.23.0</li>
<li><a
href="https://github.com/taiki-e/install-action/commit/cd319da91ecc8685df284d89c5435723973a5668"><code>cd319da</code></a>
Update <code>wasmtime@latest</code> to 45.0.2</li>
<li><a
href="https://github.com/taiki-e/install-action/commit/4942894b57b5ad6fdcb38216eb1f7df561374b20"><code>4942894</code></a>
Update cargo-xwin manifest</li>
<li>Additional commits viewable in <a
href="https://github.com/taiki-e/install-action/compare/v2.81.5...b8cecb83565409bcc297b2df6e77f030b2a468d5">compare
view</a></li>
</ul>
</details>
<br />

Updates
`hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml` from
2576c19549f6c9d3d5608955fbc636628185c89e to
3f7d0bbed133629b62052fd181a84e4e1c774f9a
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/hyperpolymath/panic-attack/blob/main/CHANGELOG.md">hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml's
changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<h2>[Unreleased]</h2>
<h3>Added — attestation unforgeability proof (Idris2, PROOF-PROGRAMME
§3.2)</h3>
<ul>

<li><strong><code>src/abi/AttestationUnforgeability.idr</code></strong>:
Idris2 proof that the
intent→evidence→seal attestation chain is unforgeable. Models
<code>chain_hash = H(intent‖evidence‖report)</code> + the Ed25519
signature with the
cryptographic facts (chain-hash collision-resistance, Ed25519 EUF-CMA
message- and signer-binding, signature correctness) as a
<code>parameters</code>
block — hypotheses, <strong>not</strong> <code>postulate</code> (PA021
bans escape hatches), so it
is an honest <em>conditional</em> theorem. Under <code>%default
total</code> it Qed-closes
<code>integrity</code> (tampering any phase invalidates the seal),
<code>authenticity</code>
(a verifying seal comes from the matching key), and
<code>nonRepudiation</code>
(a genuine seal verifies), plus two corollaries. Typechecks under Idris2
0.8.0. Closes <a
href="https://redirect.github.com/hyperpolymath/panic-attack/issues/123">#123</a>.</li>
</ul>
<h3>Added — contractile registry (INDEX.a2ml)</h3>
<ul>

<li><strong><code>.machine_readable/contractiles/INDEX.a2ml</code></strong>:
the previously-missing
contractile registry, modelled on echidna's canonical INDEX. Catalogues
all
six verbs (must / trust / intend / adjust / bust / dust) with their
<em>actual
current locations</em> across the three pre-consolidation trees, flags
the
duplicate <code>trust</code> Trustfile, and records the canonical
trident target. The
physical consolidation of the three trees stays in <a
href="https://redirect.github.com/hyperpolymath/panic-attack/issues/124">#124</a>
— it couples to the
<code>contractile gen-just</code> generator (which reads the root
<code>contractiles/</code> tree)
and needs the standards CONTRACTILE-SPEC to do safely.</li>
</ul>
<h3>Added — <code>assay</code> / <code>assimilate</code> /
<code>aggregate</code> proof-integration subcommands</h3>
<p>Three new a-themed subcommands that wire panic-attack into the
PROOF-PROGRAMME loop (survey → swap → fold-in-proofs):</p>
<ul>
<li><strong><code>panic-attack assay [TARGET] [--proven
DIR]…</code></strong> (<code>src/assay/mod.rs</code>):
surveys a target for code that has a formally proven drop-in equivalent
in a <code>proven</code> / <code>proven-servers</code> library and
reports each candidate with
the proof artifact that backs it — operationalising the &quot;Proven
cross-fit&quot;
table in <code>PROOF-PROGRAMME.md</code> mechanically instead of by
hand. Built-in
catalogue: <code>SafePath</code> (canonicalize/unwrap pattern) and
<code>SafeUrl</code>
(<code>VERISIMDB_URL</code>). On this repo: <code>safe-path</code>
<strong>Offered</strong> (port present in
<code>src/safe_path.rs</code>, call sites still to rewire),
<code>safe-url</code>
<strong>NoReplacementSource</strong> (not yet ported).</li>
<li><strong><code>panic-attack assimilate [TARGET] --candidate ID
[--proven DIR] [--from FILE] [--all] [--dry-run]</code></strong>:
performs a swap — stages the proven module into the tree, backs up the
original (<code>*.orig</code>), and writes a provenance record (source
BLAKE3 hash +
proof backing + pending call-site rewires) under
<code>.assimilated/</code>. Module
swaps are automatic; call-site rewiring is reported, never auto-edited
(mechanically editing arbitrary call sites is not a reviewable
operation).</li>
<li><strong><code>panic-attack aggregate --proof PATH… [--label
PATH=NAME] [--covers PATH=SPEC] [--report BASE]</code></strong></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/hyperpolymath/panic-attack/commit/3f7d0bbed133629b62052fd181a84e4e1c774f9a"><code>3f7d0bb</code></a>
fix(assail): UnboundedAllocation is Medium, not Critical</li>
<li><a
href="https://github.com/hyperpolymath/panic-attack/commit/6a814fa5c8b07a6bdca966471fb5ae6912bfe3b6"><code>6a814fa</code></a>
chore(deps): bump the rust-minor group with 2 updates (<a
href="https://redirect.github.com/hyperpolymath/panic-attack/issues/126">#126</a>)</li>
<li>See full diff in <a
href="https://github.com/hyperpolymath/panic-attack/compare/2576c19549f6c9d3d5608955fbc636628185c89e...3f7d0bbed133629b62052fd181a84e4e1c774f9a">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>

Author: dependabot[bot]

.github/workflows/agda-meta-checker.yml

@@ -33,7 +33,7 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
 
       # Required-check shim: only the meta-checker/ tree needs the real proof
       # check. Non-PR events (push, workflow_dispatch) always run it.

.github/workflows/boj-build.yml

@@ -17,7 +17,7 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Trigger BoJ Server (Casket/ssg-mcp)
         run: |
           # Send a secure trigger to boj-server to build this repository

.github/workflows/bridge-gate.yml

@@ -29,7 +29,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 25
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
 
       - name: B3 gate -- nix bumps (no network)
         env:

.github/workflows/cargo-audit.yml

@@ -31,7 +31,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Detect Cargo.lock
         id: detect

.github/workflows/chapel-ci.yml

@@ -61,7 +61,7 @@ jobs:
     runs-on: ubuntu-22.04
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Install Chapel ${{ env.CHAPEL_VERSION }} (SHA-pinned .deb)
         run: |
@@ -113,7 +113,7 @@ jobs:
     runs-on: ubuntu-22.04
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Install Zig
         uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29 # v2.2.1
@@ -144,7 +144,7 @@ jobs:
     needs: zig-ffi
     continue-on-error: true
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable
@@ -183,7 +183,7 @@ jobs:
     needs: [chapel-build, zig-ffi]
     continue-on-error: true
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Install Chapel ${{ env.CHAPEL_VERSION }} (SHA-pinned .deb)
         run: |

.github/workflows/codeql.yml

@@ -36,7 +36,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v3

.github/workflows/container-ci.yml

@@ -57,7 +57,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
 
       - name: Install Podman
         run: |
@@ -154,7 +154,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
 
       - name: Install Podman
         run: |

.github/workflows/dogfood-gate.yml

@@ -32,7 +32,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Check for A2ML files
         id: detect
@@ -77,7 +77,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Check for K9 files
         id: detect
@@ -127,7 +127,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Scan for invisible characters
         id: lint
@@ -192,7 +192,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Check for Groove manifest
         id: groove
@@ -251,7 +251,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Check and validate eclexiaiser manifest
         id: eclex
@@ -323,7 +323,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Generate dogfooding scorecard
         run: |

.github/workflows/dogfood-proofs-ci.yml

@@ -41,7 +41,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Install Coq
         run: |
@@ -68,7 +68,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Install elan + pinned Lean toolchain
         run: |
@@ -120,7 +120,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Install Agda + standard library
         run: |

.github/workflows/fly-deploy.yml

@@ -22,7 +22,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v4
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4
       - name: Install flyctl
         uses: superfly/flyctl-actions/setup-flyctl@ed8efb33836e8b2096c7fd3ba1c8afe303ebbff1 # main 2025-06
       - name: Deploy