build(deps): Bump actions/checkout from 7.0.0 to 7.0.1

.github/workflows/audit.yml

@@ -20,7 +20,7 @@ jobs:
   cargo-audit:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable branch, 2026-06
         with:

.github/workflows/ci.yml

@@ -26,7 +26,7 @@ jobs:
     name: Release inputs are immutable
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Check release/packaging inputs are pinned
         run: bash packaging/ci/check-pinned-inputs.sh
 
@@ -50,7 +50,7 @@ jobs:
       matrix:
         os: [ubuntu-latest, macos-latest, windows-latest]
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       # Linux links against system libraries the other platforms provide natively:
       #  - libpcsclite-dev: the `pcsc` crate (keyroost-transport). macOS uses the
@@ -109,7 +109,7 @@ jobs:
     name: MSRV (1.85, libs + CLI)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       # Only the pcsc link is needed: the excluded GUI is what pulls the
       # X11/Wayland/GL set, and everything else here is pure Rust.
@@ -140,7 +140,7 @@ jobs:
     name: Future-incompatibility report
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install Linux system dependencies
         run: |
           sudo apt-get update
@@ -213,7 +213,7 @@ jobs:
             libxkbcommon libxcb wayland mesa \
             rust
 
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Build
         run: cargo build --workspace --locked

.github/workflows/deps-outdated.yml

@@ -19,7 +19,7 @@ jobs:
     name: cargo outdated report
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       # Build scripts (pcsc-sys etc.) can run during metadata resolution.
       - name: Install system dependencies

.github/workflows/fuzz.yml

@@ -36,7 +36,7 @@ jobs:
           - winhid_detail
           - otp_apdu_retry
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable branch, 2026-06
         with:

.github/workflows/linux-bundles.yml

@@ -105,7 +105,7 @@ jobs:
       id-token: write # attest-build-provenance signs the AppImage
       attestations: write
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       # A dispatch builds from an arbitrary ref but publishes into $TAG's
       # release. Refuse the combination when the tree disagrees with the tag,
@@ -227,7 +227,7 @@ jobs:
     # freedesktop container image is Fedora-based and does not ship the gh CLI,
     # so publishing from inside it would be fragile.
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       # A dispatch builds from an arbitrary ref but publishes into $TAG's
       # release. Refuse the combination when the tree disagrees with the tag,

.github/workflows/pages.yml

@@ -38,7 +38,7 @@ jobs:
       url: ${{ steps.deployment.outputs.page_url }}
     steps:
       - name: Check out
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Stage the published site
         # Publish the static Learn site only. Everything removed below stays in
         # the repo (and public on github.com) — it's just not surfaced on the

.github/workflows/publish.yml

@@ -42,7 +42,7 @@ jobs:
       contents: read
       id-token: write # OIDC exchange for a temporary crates.io token
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.event.release.tag_name || inputs.tag }}
 
@@ -129,7 +129,7 @@ jobs:
             echo "ready=true" >> "$GITHUB_OUTPUT"
           fi
 
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         if: steps.guard.outputs.ready == 'true'
         with:
           ref: ${{ github.event.release.tag_name || inputs.tag }}
@@ -189,7 +189,7 @@ jobs:
             echo "ready=true" >> "$GITHUB_OUTPUT"
           fi
 
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         if: steps.guard.outputs.ready == 'true'
         with:
           ref: ${{ github.event.release.tag_name || inputs.tag }}

.github/workflows/release.yml

@@ -32,7 +32,7 @@ jobs:
     name: Linux x86_64
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install system dependencies
         run: |
@@ -68,7 +68,7 @@ jobs:
     name: macOS universal2
     runs-on: macos-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       # PC/SC (PCSC.framework) and the FIDO HID backend (IOKit via hidapi) come
       # from the system SDK — no extra packages. Build both arches and lipo them
@@ -104,7 +104,7 @@ jobs:
     name: Windows x86_64
     runs-on: windows-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       # PC/SC (WinSCard) and the FIDO HID backend (hid.dll via hidapi) are part
       # of Windows — no extra packages. The GUI is built with the windows