Consolidate admitted GitHub Actions upgrades

[JacobLinCool]

Summary

• upgrade actions/checkout to v7.0.0, actions/setup-node to v7.0.0, pnpm/action-setup to v6.0.9, and actions/attest-build-provenance to v4.1.1
• synchronize the workflow admission allowlist with the exact pinned, upstream-verified commit SHAs
• refresh server/browser conformance evidence for the resulting source tree

This supersedes #1, #2, #3, and #4. Each individual Dependabot PR changed only its workflow pin, so the Forge fail-closed workflow admission check correctly rejected it until the allowlist was reviewed and updated in the same change.

Verification

• official version tags resolve to the pinned commits and each upstream commit has a valid GitHub signature
• pnpm run github:verify
• server conformance: 21/21 cases passed
• browser conformance: 21/21 cases passed
• formal matrix: 42 samples, 3 repetitions, zero mismatches
• pnpm run ci:verify
  • 415 Vitest tests passed (10 skipped)
  • packed npm package and strict NodeNext consumer verified
  • site production build passed
  • 65 Rust runtime/CLI tests passed
  • wasm32 web target check passed