ci: update checkout action to v7

[steipete]

Summary

• Update every workflow use of actions/checkout from v6 to v7.
• Record the maintenance update in the 0.3.2 changelog.

Dependency review

• Stable upstream: https://github.com/actions/checkout/releases/tag/v7.0.0 (released 2026-06-18).
• Compatibility: v6 and v7 both use Node 24; existing inputs remain valid, including fetch-depth: 0 in the release workflow.
• Security/health: v7 adds safer fork checkout handling plus dependency security fixes; this repository does not use the affected pull_request_target or workflow_run checkout pattern. Upstream's release commit passed macOS, Linux, Windows, proxy, build, dist, license, and CodeQL checks.
• Other direct dependencies: Commander 0.2.2 and the remaining GitHub Actions major tags are current stable releases.

Proof

• actionlint .github/workflows/*.yml
• make check: strict format/SwiftLint; 65 tests; RemindCore coverage 91.1% (613/673; 90% required)
• make docs-site
• make macos-artifact: verified universal x86_64 + arm64 archive
• Autoreview (--mode local, Codex): clean; no accepted/actionable findings

Metadata/CI-only change; no Reminders runtime behavior or external live boundary changed. No release, version bump, tag, or publishing action included.

[steipete]

Landed as f784035.

Verification:

• actionlint .github/workflows/*.yml passed.
• make check passed: strict format/SwiftLint, 65 tests, RemindCore coverage 91.1% (613/673; 90% required).
• make docs-site passed.
• make macos-artifact produced and verified a universal x86_64 + arm64 archive.
• Autoreview (--mode local, Codex) returned no accepted/actionable findings.
• Exact PR-head CI passed: run 28498916527.
• Post-merge main CI passed: run 28498996805.
• Post-merge Pages deployment passed: run 28498996777.

This was a CI-metadata-only update; no Reminders runtime behavior or external live boundary changed. No release, version bump, tag, or publishing action performed.