chore(deps): bump the actions group across 1 directory with 7 updates

.github/workflows/actions.lock

@@ -21,18 +21,18 @@ workflows:
         - 'google/clusterfuzzlite@v1'
     '.github/workflows/ci-meta.yml':
         - 'actions/checkout@v7.0.1'
-        - 'hyperpolymath/cicd-squabbler@541ab9bc21a776d55eb46611877521a824d6319c'
+        - 'hyperpolymath/cicd-squabbler@79d7dbacc8a02b4a4388b4a36fe46893b5b7ce73'
     '.github/workflows/codeql.yml':
         - 'actions/checkout@v7.0.1'
-        - 'github/codeql-action@9b3254085494b55a0f7c4c2b3d2d52cc712ce370'
+        - 'github/codeql-action@33d7b85da1a04171e211befe2c739303b9a4c066'
     '.github/workflows/coq-build.yml':
         - 'actions/checkout@v7.0.1'
     '.github/workflows/deep-recon.yml':
         - 'actions/cache@v6.1.0'
         - 'actions/checkout@v7.0.1'
         - 'actions/upload-artifact@v7.0.2'
         - 'dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8'
-        - 'github/codeql-action@9b3254085494b55a0f7c4c2b3d2d52cc712ce370'
+        - 'github/codeql-action@33d7b85da1a04171e211befe2c739303b9a4c066'
     '.github/workflows/doc-consonance.yml':
         - 'actions/checkout@v7.0.1'
     '.github/workflows/dogfood-gate.yml':
@@ -47,7 +47,7 @@ workflows:
     '.github/workflows/ghcr-publish.yml':
         - 'actions/attest-build-provenance@v4.2.2'
         - 'actions/checkout@v7.0.1'
-        - 'step-security/harden-runner@v2.22.2'
+        - 'step-security/harden-runner@v2.22.3'
     '.github/workflows/governance.yml':
         - 'metadatastician/standards@8e48b1caade08a552646adeab66558ac43b4360d'
     '.github/workflows/hypatia-scan.yml':
@@ -67,7 +67,7 @@ workflows:
         - 'actions/checkout@v7.0.1'
         - 'actions/upload-artifact@v7.0.2'
         - 'dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8'
-        - 'taiki-e/install-action@v2.87.30'
+        - 'taiki-e/install-action@v2.90.1'
     '.github/workflows/pages.yml':
         - 'actions/checkout@v7.0.1'
         - 'actions/deploy-pages@v5.0.1'
@@ -83,7 +83,7 @@ workflows:
         - 'actions/upload-artifact@v7.0.2'
         - 'dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8'
         - 'rustsec/audit-check@v2.0.0'
-        - 'taiki-e/install-action@v2.87.30'
+        - 'taiki-e/install-action@v2.90.1'
     '.github/workflows/scorecard.yml':
         - 'metadatastician/standards@8e48b1caade08a552646adeab66558ac43b4360d'
     '.github/workflows/secret-scanner.yml':
@@ -176,9 +176,9 @@ dependencies:
         commit: 'sha1-54075bcc5e249e4758d363f27d099f55d843f124'
         owner_id: 47606891
         repo_id: 331103973
-    'github/codeql-action@9b3254085494b55a0f7c4c2b3d2d52cc712ce370':
-        ref: 'v4.39.1'
-        commit: 'sha1-9b3254085494b55a0f7c4c2b3d2d52cc712ce370'
+    'github/codeql-action@33d7b85da1a04171e211befe2c739303b9a4c066':
+        ref: 'v4.39.3'
+        commit: 'sha1-33d7b85da1a04171e211befe2c739303b9a4c066'
         owner_id: 9919
         repo_id: 259445878
     'github/codeql-action@b96794f015dfd88f77b49b1c93e0fa7110f94c63':
@@ -191,9 +191,9 @@ dependencies:
         commit: 'sha1-884713a6c30a92e5e8544c39945cd7cb630abcd1'
         owner_id: 1342004
         repo_id: 400046858
-    'hyperpolymath/cicd-squabbler@541ab9bc21a776d55eb46611877521a824d6319c':
+    'hyperpolymath/cicd-squabbler@79d7dbacc8a02b4a4388b4a36fe46893b5b7ce73':
         ref: 'main'
-        commit: 'sha1-541ab9bc21a776d55eb46611877521a824d6319c'
+        commit: 'sha1-79d7dbacc8a02b4a4388b4a36fe46893b5b7ce73'
         owner_id: 6759885
         repo_id: 1284026967
     'metadatastician/standards@8e48b1caade08a552646adeab66558ac43b4360d':
@@ -233,14 +233,14 @@ dependencies:
         commit: 'sha1-69366f33c96575abad1ee0dba8212993eecbe998'
         owner_id: 25397242
         repo_id: 523199201
-    'step-security/harden-runner@v2.22.2':
-        ref: 'v2.22.2'
-        commit: 'sha1-dc2769abcc0fcfbadfc1df54081c1608579ef6b2'
+    'step-security/harden-runner@v2.22.3':
+        ref: 'v2.22.3'
+        commit: 'sha1-46b06cea07f9e64621fdf066ba77ac6915163d43'
         owner_id: 88700172
         repo_id: 422287306
-    'taiki-e/install-action@v2.87.30':
-        ref: 'v2.87.30'
-        commit: 'sha1-a4d3f3f761dcd95cce1b72cb61cb6d1963438177'
+    'taiki-e/install-action@v2.90.1':
+        ref: 'v2.90.1'
+        commit: 'sha1-c509219cf42fba86913069efd0ade2458c59337b'
         owner_id: 43724913
         repo_id: 442947557
     'webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555':

.github/workflows/ci-meta.yml

@@ -80,7 +80,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Cross-repo CI dependency graph (read-only)
-        uses: hyperpolymath/cicd-squabbler/.github/actions/squabble@541ab9bc21a776d55eb46611877521a824d6319c
+        uses: hyperpolymath/cicd-squabbler/.github/actions/squabble@79d7dbacc8a02b4a4388b4a36fe46893b5b7ce73
         with:
           args: |
             chains

.github/workflows/codeql.yml

@@ -43,12 +43,12 @@ jobs:
           persist-credentials: false
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.38.0 (4.38.1 blocked estate-wide; nexia-list#100)
+        uses: github/codeql-action/init@33d7b85da1a04171e211befe2c739303b9a4c066 # v4.38.0 (4.38.1 blocked estate-wide; nexia-list#100)
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.38.0 (4.38.1 blocked estate-wide; nexia-list#100)
+        uses: github/codeql-action/analyze@33d7b85da1a04171e211befe2c739303b9a4c066 # v4.38.0 (4.38.1 blocked estate-wide; nexia-list#100)
         with:
           category: "/language:${{ matrix.language }}"

.github/workflows/deep-recon.yml

@@ -84,7 +84,7 @@ jobs:
       # and the pons-report artifact carries the SARIF.
       - name: Upload SARIF
         if: always() && github.event_name != 'pull_request'
-        uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.38.0 (4.38.1 blocked estate-wide; nexia-list#100)
+        uses: github/codeql-action/upload-sarif@33d7b85da1a04171e211befe2c739303b9a4c066 # v4.38.0 (4.38.1 blocked estate-wide; nexia-list#100)
         with:
           sarif_file: pons.sarif
           category: pons-asinorum

.github/workflows/ghcr-publish.yml

@@ -41,7 +41,7 @@ jobs:
       # monitor its outbound egress (audit mode; tighten to block with an
       # allowlist once the endpoint set is observed stable).
       - name: Harden runner (egress audit)
-        uses: step-security/harden-runner@v2.22.2
+        uses: step-security/harden-runner@v2.22.3
         with:
           egress-policy: audit
       - uses: actions/checkout@v7.0.1

.github/workflows/nightly.yml

@@ -39,7 +39,7 @@ jobs:
       - uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # v1
         with:
           toolchain: stable
-      - uses: taiki-e/install-action@v2.87.30
+      - uses: taiki-e/install-action@v2.90.1
         with:
           tool: cargo-mutants
       - name: Run mutation tests
@@ -74,7 +74,7 @@ jobs:
       - uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # v1
         with:
           toolchain: stable
-      - uses: taiki-e/install-action@v2.87.30
+      - uses: taiki-e/install-action@v2.90.1
         with:
           tool: cargo-hack
       - name: Check every feature combination compiles

.github/workflows/rust-ci.yml

@@ -101,7 +101,7 @@ jobs:
       - uses: actions/checkout@v7.0.1
         with:
           persist-credentials: false
-      - uses: taiki-e/install-action@v2.87.30
+      - uses: taiki-e/install-action@v2.90.1
         with:
           tool: cargo-deny
       - run: cargo deny check advisories bans licenses sources
@@ -131,7 +131,7 @@ jobs:
         with:
           toolchain: stable
           components: llvm-tools-preview
-      - uses: taiki-e/install-action@v2.87.30
+      - uses: taiki-e/install-action@v2.90.1
         with:
           tool: cargo-llvm-cov
       - name: Generate lcov report
@@ -155,7 +155,7 @@ jobs:
       - uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # v1
         with:
           toolchain: stable
-      - uses: taiki-e/install-action@v2.87.30
+      - uses: taiki-e/install-action@v2.90.1
         with:
           tool: cargo-mutants
       - name: Run mutation tests on core invariant crates
@@ -238,7 +238,7 @@ jobs:
         with:
           toolchain: stable
       - if: steps.detect.outputs.relevant == 'true'
-        uses: taiki-e/install-action@v2.87.30
+        uses: taiki-e/install-action@v2.90.1
         with:
           tool: cargo-mutants
       - name: Mutate only lines changed against the base

.github/workflows/security-scan.yml

@@ -38,7 +38,7 @@ jobs:
     #
     # Pin includes canonical .affine language detection and preserves
     # JSON.parseExn coverage after the ReScript-to-AffineScript migration.
-    uses: hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml@b22bed4f8c6dce82fde639aa0dab9ce79d1006f5 # main 2026-10-25
+    uses: hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml@f2a6a70eaec0cb02331e3264e05f185b5faab0f7 # main 2026-10-25
     with:
       # This lane reported success regardless of findings for its whole life
       # (the reusable's default is 'none' for backwards compatibility).