chore(deps): bump the actions group with 6 updates

[jeremi]

Supersedes #783, which was opened before v0.23.0 and could not be merged
as-is: it was based on a commit predating the h2 RUSTSEC-2026-0258 fix,
and it moved a SHA that a release gate pins by exact value.

This branch carries Dependabot's commit unchanged, rebased onto current
main, plus one commit that moves the gate with it.

The six bumps, each resolved against upstream

Action	New pin	Upstream ref
actions/download-artifact	3e5f45b2	tags v8, v8.0.1
astral-sh/setup-uv	20cfd1bf	tag v10.0.1
github/codeql-action/init	ff2f1c62	tag v4.37.7
github/codeql-action/analyze	ff2f1c62	tag v4.37.7
taiki-e/install-action	288e7469	tag v2.86.1
Swatinem/rust-cache	f0d9c388	untagged master commit, 2026-08-17

Review notes (security-sensitive)

actions/download-artifact runs in platform-coverage-upload, the only
job in root CI holding id-token: write. That is why
platform_coverage_oidc_isolation_violations in
release/scripts/check-gates-inventory.py pins its commit by exact
value, and why this change has to touch both .github/ and release/:
the gate is a mirror of the workflow line, so they move together or root
CI stays red.

Two things worth a human eye:

1. The pin was drifting. main currently pins
   d3f86a10, which is v4.3.0 (April 2025), while its trailing
   comment reads # v8.0.0. The comment has been overstating the pinned
   release. This change moves the pin to a commit genuinely tagged
   v8.0.1 and corrects the comment to match.

2. v4.3.0 to v8.0.1 crosses four majors. Checked against our exact
   usage, which downloads a single artifact by name:

   • v5.0.0's breaking change only affects downloads by artifact-ids.
     Not us.
   • v6.0.0 and v7.0.0 are Node 24 moves requiring runner >= 2.327.1.
     The job is GitHub-hosted ubuntu-24.04.
   • v8.0.0 migrates to ESM (transparent to callers), skips decompression
     by Content-Type, and changes digest mismatch from a warning to a
     hard error. Our artifact is an ordinary zip from
     actions/upload-artifact@v7.0.1, so decompression is unaffected, and
     the stricter digest default is an integrity improvement for an
     OIDC-bearing job.

Swatinem/rust-cache is pinned to an untagged master commit. So was
the pin it replaces (258712b0, 2026-08-12, also untagged), so this is
the existing pattern rather than a change in posture. Flagging it because
the # v2 comment on that line names a tag that neither the old nor the
new SHA points at.

Verification

Run against the rebased tree:

• python3 release/scripts/check-gates-inventory.py -> passed, 151 gates
• python3 -m unittest release/scripts/test_check_gates_inventory.py -> 53 tests OK
• python3 .github/scripts/test_ci_changes.py -> 61 tests OK
• release/scripts/registry-release validate-current -> beta-34 0.23.0
• release/scripts/registry-release validate-docsets -> 25 docsets
• release/scripts/registry-release audit release/manifests/import-map-2026-06-24.yaml -> 7 imports
• cargo deny check advisories -> ok

The lockfile is untouched by this branch, so the cargo deny failure on
#783 was purely its stale base.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5f743def08

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".