[dependabot:release-train-updater] Bump actions/checkout to v7.0.1 in ci.yml and sync-actions.yml

## Dependency Release Train Summary

### What changed
- Package/ecosystem: GitHub Actions
- Manifest(s): `.github/workflows/ci.yml`, `.github/workflows/sync-actions.yml` (in `github/gh-aw-actions`, rendered as inline code — not a live cross-reference)
- Old version: `actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683` (v4.2.2)
- New version: `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1` (v7.0.1)
- Update type: freshness/consistency (SHA-pinned action bump)

### Why now
`ci.yml` and `sync-actions.yml` in `github/gh-aw-actions` are still pinned to `actions/checkout` v4.2.2, while `agentics-maintenance.yml` in the same repo already uses v7.0.0. Bumping to the current latest v7.0.1 removes this drift and keeps all workflows on one supported major version.

### Risk assessment
- Runtime/dev/build/CI scope: CI-only, GitHub Actions checkout step.
- Direct dependency (workflow `uses:` pin).
- Reachability: Used only for a basic `persist-credentials: false` checkout in both files — no advanced inputs affected by the version bump.
- No auth/crypto/payment/database/serialization impact.

### Validation
- Commands run: Verified `v7.0.1` tag → commit SHA via GitHub API; confirmed no other files reference the old pinned SHA outside the two workflows; diffed generated patch to confirm only the pin/version comment changed.
- Result: Diff is minimal and isolated to the two checkout steps that needed updating.
- Remaining gaps: Could not execute the target repository's own CI (zizmor, workflow runs) from this sandbox — recommend standard CI validation once applied to `github/gh-aw-actions`.

### Control Plane
- Correlation ID: 33867440259-38
- Central repo: githubnext/gh-aw-cao
- Run URL: https://github.com/githubnext/gh-aw-cao/actions/runs/33867440259

**Action:** A maintainer with write access to `github/gh-aw-actions` should apply the attached patch (see published review-bundle artifact `actions-checkout-v7.0.1`) as a real pull request there, since this run only has review-mode access to `githubnext/gh-aw-cao`. Acceptance check: CI (including zizmor) passes on the resulting PR in `github/gh-aw-actions`.

Agent prompt

Apply the following change to `github/gh-aw-actions`:

In `.github/workflows/ci.yml` and `.github/workflows/sync-actions.yml`, replace every occurrence of:

```
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
```

with:

```
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
```

Open a pull request with this change, and let CI (including the zizmor workflow-lint job) run to validate.

Sensitive surface area / breaking-change notes

- Sensitive surface area: none (CI checkout step only, no runtime/auth/crypto/payment code touched).
- Breaking-change notes: `actions/checkout` v5–v7 changed default Node runtime and dropped some legacy inputs, but neither workflow uses any of the removed/changed inputs — both call it with only `persist-credentials: false`.

### Reviewer checklist
- [ ] CI passes (including zizmor) on the resulting PR in `github/gh-aw-actions`
- [ ] CODEOWNERS/service owners reviewed
- [ ] Security-sensitive areas approved, if applicable (N/A here)
- [ ] Deployment/canary owner confirms runtime health, if needed (N/A, CI-only change)

### Rollback guidance
- Revert the pin back to `actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2` in both files if issues arise.

Smart-Dependabot-Merge-Candidate: yes

> Generated by [:dependabot: Dependabot / Release Trains](https://github.com/githubnext/gh-aw-cao/actions/runs/33867887086) · copilot · auto · 47.9 AIC · ⌖ 9.71 AIC · ⊞ 20.5K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fdependabot-release-train-updater%22&type=issues)
>

_{Add this agentic workflow to your repo}

To install this agentic workflow, run

```
gh aw add githubnext/gh-aw-cao/.github/workflows/dependabot-release-train-updater.md@main
```

> - [x] expires on Sep 18, 2026, 11:36 AM UTC

Update the checkout pins in .github/workflows/ci.yml and .github/workflows/sync-actions.yml from v4.2.2 to v7.0.1, using the specified commit SHA. Review the minimal diff, then open a pull request in github/gh-aw-actions and run CI, including the zizmor workflow-lint job. Done means both workflows use the new pin and CI passes.

Written by the indexing model from the issue text.