Qualify GitHub Actions v7 dependency upgrades

[leehack]

Scope

Track and qualify the three open Dependabot major-version upgrades:

• PR chore(deps): bump codecov/codecov-action from 6 to 7 #438: codecov/codecov-action v6 to v7
• PR chore(deps): bump actions/upload-artifact from 6 to 7 #439: actions/upload-artifact v6 to v7
• PR chore(deps): bump actions/checkout from 6 to 7 #440: actions/checkout v6 to v7

Required validation

• Integrate current main normally and do not force-push.
• Review upstream release and migration notes for breaking input, permission, runtime, artifact, and token behavior.
• Preserve least-privilege permissions and existing provenance, coverage, artifact-retention, checkout-depth, submodule, and credential contracts.
• Merge sequentially so each subsequent PR is refreshed and revalidated on current main.
• Require exact-head CI, zero unresolved review threads, and independent blocking-only QA before mark-ready.
• Verify post-merge workflows after each accepted upgrade.

Acceptance criteria

• Each upgrade is either merged with exact-current-main evidence or closed with a documented compatibility reason.
• No workflow permission, artifact, provenance, coverage, or checkout regression is introduced.
• Existing action versions remain acceptable for the next release, so this issue is not itself release-blocking unless upstream security or compatibility evidence changes.