Refresh GitHub Actions for Node 24

[HLLMR]

Summary

• pin actions/checkout v7.0.1 at exact upstream SHA 3d3c42e5aac5ba805825da76410c181273ba90b1
• pin actions/setup-python v7.0.0 at exact upstream SHA 5fda3b95a4ea91299a34e894583c3862153e4b97
• preserve the existing OS/Python matrix, permissions, provisioning, focused/full split, and stable CI required check
• add exact-pin regression coverage rejecting both former action SHAs

Evidence

• focused workflow contract: 3 tests passed
• full Windows governed-source suite: 715 tests passed, 2 skipped
• distribution, identity, licensing, dispatch, whitespace, and cache-residue gates passed
• two independent no-path public projections: 131 files each, checker-clean, byte-identical
• fresh independent review: ACCEPT

Closes #11