Update each action to its current latest release and pin to the full commit
SHA (supply-chain hardening), with the version in a trailing comment:
* actions/checkout v4 -> v7.0.0
* Swatinem/rust-cache v2 -> v2.9.1
* actions/upload-artifact v4 -> v7.0.1
* actions/download-artifact v4 -> v8.0.1
* softprops/action-gh-release v2 -> v3.0.1
* dtolnay/rust-toolchain pinned to master @ 2026-06-20 (no tagged
releases); add explicit `toolchain: stable` since the channel can no
longer be inferred from the @ref once pinned to a SHA.
Verified upload-artifact v7 (zips by default) and download-artifact v8
interoperate, and that every input still exists in the new majors.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
JMR-devandClaude Opus 4.8
f776172d57