[dependabot]

Why

Refresh the pinned GitHub Actions and keep the generated evidence dashboard consistent with the release workflow.

What changed

• Update setup-uv to 10.3.0, upload-artifact to 7.0.2, download-artifact to 8.0.2, and sbom-action to 0.24.3.
• Regenerate the dashboard JSON and HTML with the new release-workflow digest.

Validation

• go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.12: passed.
• uv tool run --from zizmor==1.25.2 zizmor --min-severity low .github/workflows: passed.
• Existing CI, release, E2E workflow, hardening, and evidence-dashboard contract tests: passed.
• Dashboard regeneration is stable after committing; git diff --check passed.
• All required checks and relevant cross-platform, browser, mutation, relevance, benchmark, daemon, and MCP checks passed on 73161656d91306aa6efa72a2607b65b4eac5e91a. The skips are PR publishing jobs and the manually triggered full public matrix.

These are proportional local checks for action references and generated evidence. The complete Rust and platform checks run in CI.

Evidence

Each pinned action SHA matches its official upstream version tag. No performance or relevance claim is made.

Risk

No workflow permissions or step inputs change. The updated actions use Node 24, which the hosted runners support. The release-only SBOM step is covered by configuration checks; an actual release is not exercised here.

The prior Windows neural release smoke failed while renaming a live SQLite index. The same Rust code passed on main and on the preceding action-update PR. Its artifact did not capture the failing daemon path. The repaired head passed both Windows release smoke and unit/integration suites. A deterministic regression for cached branch readers during staged base replacement remains a follow-up.

Checklist

• Change is focused and follows existing project patterns.
• Tests cover changed behavior or regression, or testing is not applicable.
• ./test.sh --quick passed during iteration.
• ./test.sh passes, or Validation explains narrower proportional checks.
• Relevant CLI, daemon, MCP, browser, neural, or artifact E2E passes, or E2E is not applicable.
• User-facing docs and changelog are updated when needed.
• Performance and relevance claims include reproducible evidence.
• No private code, credentials, generated caches, or local paths are committed.

[bvolpato]

[review-prs-verification]

Reviewed head: 73161656d91306aa6efa72a2607b65b4eac5e91a against main 756ff1941a75284c7743acc8be8be6edfdcdf36c.

Verified the four action pins against official release tags, reviewed workflow permissions and inputs, and regenerated the dashboard JSON/HTML for the changed release-workflow digest. Actionlint, zizmor, existing workflow/evidence contract tests, and stable regeneration passed locally. All required checks and relevant platform, browser, mutation, relevance, benchmark, daemon, and MCP checks passed on this head. There are no unresolved review threads.

The earlier Windows SQLite rename failure did not repeat: fresh release smoke and Windows tests passed. Its exact cause is unproven; cached readers during staged base recovery warrant a deterministic Windows regression. The release-only SBOM path was checked statically, without creating a release.

Ready to merge: yes