build(deps): bump the actions group across 1 directory with 4 updates

.github/workflows/actions.lock

@@ -1,9 +1,6 @@
 # This file is machine-generated by `gh actions-lock`.
 # Do not edit by hand; run `gh actions-lock` to update.
 # Docs: https://gh.io/actions-lockfile
-#
-# Regenerated 2026-10-15 to close every dangling edge (the startup_failure cause)
-# and onboard all 36 workflows. Verified with scripts/check-lock-sync.sh locally.
 version: 'v0.0.3'
 workflows:
     '.github/workflows/build-notification.yml':
@@ -65,15 +62,15 @@ workflows:
     '.github/workflows/proofs.yml':
         - 'actions/checkout@v7.0.1'
     '.github/workflows/push-email-notify.yml':
-        - 'hyperpolymath/smtp-notify-action@v0.5.0'
+        - 'hyperpolymath/smtp-notify-action@v0.5.1'
     '.github/workflows/quality.yml':
         - 'actions/checkout@v7.0.1'
         - 'editorconfig-checker/action-editorconfig-checker@v3.0.0'
     '.github/workflows/release.yml':
         - 'actions/attest-build-provenance@v4.2.2'
         - 'actions/checkout@v7.0.1'
         - 'actions/upload-artifact@v7.0.2'
-        - 'softprops/action-gh-release@v3.0.3'
+        - 'softprops/action-gh-release@v3.0.4'
     '.github/workflows/rsr-compliance-canary.yml':
         - 'actions/checkout@v7.0.1'
     '.github/workflows/runtime-policy.yml':
@@ -88,10 +85,10 @@ workflows:
         - 'actions/checkout@v7.0.1'
     '.github/workflows/session-ir.yml':
         - 'actions/checkout@v7.0.1'
-        - 'julia-actions/setup-julia@v2.7.0'
+        - 'julia-actions/setup-julia@v3.0.3'
     '.github/workflows/sonarqube.yml':
-        - 'SonarSource/sonarqube-scan-action@v8.3.0'
         - 'actions/checkout@v7.0.1'
+        - 'sonarsource/sonarqube-scan-action@v8.4.1'
     '.github/workflows/static-analysis-gate.yml':
         - 'actions/checkout@v7.0.1'
         - 'actions/download-artifact@v8.0.2'
@@ -101,11 +98,6 @@ workflows:
         - 'actions/checkout@v7.0.1'
         - 'oven-sh/setup-bun@v2.2.0'
 dependencies:
-    'SonarSource/sonarqube-scan-action@v8.3.0':
-        ref: 'v8.3.0'
-        commit: 'sha1-d209202bc7d53ff1cc128f7f907dac145c9d6ae9'
-        owner_id: 545988
-        repo_id: 366408409
     'actions/attest-build-provenance@v4.2.2':
         ref: 'v4.2.2'
         commit: 'sha1-4d101475d8b20a2381f78447822ac1eab6504dd8'
@@ -114,7 +106,7 @@ dependencies:
         uses:
             - 'actions/attest@508db95dd578ae2727ebd6217d5ba78e4fbda05d'
     'actions/attest@508db95dd578ae2727ebd6217d5ba78e4fbda05d':
-        ref: '508db95dd578ae2727ebd6217d5ba78e4fbda05d'
+        ref: 'v4.2.1'
         commit: 'sha1-508db95dd578ae2727ebd6217d5ba78e4fbda05d'
         owner_id: 44036562
         repo_id: 760701061
@@ -200,28 +192,33 @@ dependencies:
         commit: 'sha1-89f3c2702f4f650a92aa7411502f38da06abd562'
         owner_id: 6759885
         repo_id: 1275650185
-    'hyperpolymath/smtp-notify-action@v0.5.0':
-        ref: 'v0.5.0'
-        commit: 'sha1-c1c9fa07992a02c1fd3d67a0dc1b08cccb852aef'
+    'hyperpolymath/smtp-notify-action@v0.5.1':
+        ref: 'v0.5.1'
+        commit: 'sha1-e384daf6167a7a7567642d6a62060106244d2413'
         owner_id: 6759885
         repo_id: 1352485172
     'hyperpolymath/standards@94572e612a7bf11f8e6343d19adadf17ef2a3de3':
         ref: '94572e612a7bf11f8e6343d19adadf17ef2a3de3'
         commit: 'sha1-94572e612a7bf11f8e6343d19adadf17ef2a3de3'
         owner_id: 6759885
         repo_id: 1116521501
-    'julia-actions/setup-julia@v2.7.0':
-        ref: 'v2.7.0'
-        commit: 'sha1-4c0cb0fce8556fdb04a90347310e5db8b1f98fb9'
+    'julia-actions/setup-julia@v3.0.3':
+        ref: 'v3.0.3'
+        commit: 'sha1-da908477b5db94c10ffce8cfea9f2b3b9d5db687'
         owner_id: 53965732
         repo_id: 202020219
     'oven-sh/setup-bun@v2.2.0':
         ref: 'v2.2.0'
         commit: 'sha1-0c5077e51419868618aeaa5fe8019c62421857d6'
         owner_id: 108928776
         repo_id: 512644635
-    'softprops/action-gh-release@v3.0.3':
-        ref: 'v3.0.3'
-        commit: 'sha1-efb35369e0ad2afab669f228072c1b0d510eae64'
+    'softprops/action-gh-release@v3.0.4':
+        ref: 'v3.0.4'
+        commit: 'sha1-8a0cd651e5b2365bd640854a3fa5dfc70e4875f3'
         owner_id: 2242
         repo_id: 204253808
+    'sonarsource/sonarqube-scan-action@v8.4.1':
+        ref: 'v8.4.1'
+        commit: 'sha1-e805d875275f728fac1885b413934be6d7c63f65'
+        owner_id: 545988
+        repo_id: 366408409

.github/workflows/push-email-notify.yml

@@ -39,7 +39,7 @@ jobs:
     timeout-minutes: 5
     steps:
       - name: Send push notification email
-        uses: hyperpolymath/smtp-notify-action@v0.5.0 # NOSONAR — pin authority is actions.lock (sha1-22e7bdb322c430c1d0dac6b3bb307f4bb139d0be)
+        uses: hyperpolymath/smtp-notify-action@v0.5.1 # NOSONAR — pin authority is actions.lock (sha1-22e7bdb322c430c1d0dac6b3bb307f4bb139d0be)
         with:
           server_address: ${{ secrets.SMTP_HOST }}
           server_port: ${{ secrets.SMTP_PORT }}

.github/workflows/release.yml

@@ -133,7 +133,7 @@ jobs:
       #     name: release-artifacts
       #     path: artifacts/
       - name: Create GitHub Release
-        uses: softprops/action-gh-release@v3.0.3
+        uses: softprops/action-gh-release@v3.0.4
         with:
           body: ${{ needs.changelog.outputs.changelog }}
           draft: false

.github/workflows/session-ir.yml

@@ -50,7 +50,7 @@
     timeout-minutes: 15
     steps:
       - uses: actions/checkout@v7.0.1
-      - uses: julia-actions/setup-julia@v2.7.0
+      - uses: julia-actions/setup-julia@v3.0.3
         with:
           version: "1.10"
 
@@ -62,7 +62,7 @@
           set -euo pipefail
           julia --project=src/julia src/julia/bin/sessionir.jl test examples/session_ir/manifest.json
 
       - name: Repo shape gates and kill-test audit
         # The runnable slice of scripts/check.sh: root allowlist, docs .md
         # policy, and the Phase 0 kill-test block (four sentences, banned word
         # absent). Proof stages are excluded by design (see proofs.yml).

.github/workflows/sonarqube.yml

@@ -64,6 +64,6 @@ jobs:
 
       - name: SonarQube Scan
         if: steps.cfg.outputs.configured == 'true'
-        uses: SonarSource/sonarqube-scan-action@v8.3.0
+        uses: SonarSource/sonarqube-scan-action@v8.4.1
         env:
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}