[dependabot:release-train-updater] Review-mode dependency bundle: bump actions/checkout to v7.0.1 in gh-aw-workshop

Routine freshness update identified for target repository `githubnext/gh-aw-workshop`.

**Action:** A maintainer with write access to `githubnext/gh-aw-workshop` should review the attached bundle and open a PR there bumping `actions/checkout@v7.0.0` → `v7.0.1` in `.github/workflows/manual-semver-release.md` (line 123), then run `gh aw compile` to regenerate `manual-semver-release.lock.yml`. Acceptance check: the compiled lock file's checkout step resolves to commit `3d3c42e5aac5ba805825da76410c181273ba90b1` and CI passes.

### What changed
- Ecosystem: GitHub Actions
- Manifest: `.github/workflows/manual-semver-release.md`
- Old version: `actions/checkout@v7.0.0`
- New version: `actions/checkout@v7.0.1`
- Update type: patch

### Why now
`githubnext/gh-aw-workshop` has no application dependency manifests (package.json/requirements.txt/go.mod/etc.) — it's a workshop content repo. Its only dependency surface is pinned GitHub Actions in `.github/workflows/*.md` (gh-aw sources). All other `actions/checkout` and `actions/github-script` pins across its compiled `.lock.yml` files already resolve to current releases (checkout SHA `3d3c42e5aac5ba805825da76410c181273ba90b1` = v7.0.1, github-script SHA `3a2844b7e9c422d3c10d287c895573f7108da1b3` = v9.0.0). The one exception is `manual-semver-release.md`, which hardcodes the stale tag `actions/checkout@v7.0.0` — one patch behind current `v7.0.1` (bugfix release, no breaking changes: https://github.com/actions/checkout/releases/tag/v7.0.1).

Risk assessment

- Scope: CI/build tooling only (checkout step in a release-automation workflow), not application runtime.
- Direct, explicit pin.
- v7.0.1 is patch-level: unsafe PR input check skip, branch-name whitespace trim, `--unset` value escaping. No API/behavior breaking changes.
- Confidence: high. Merge candidate: yes (non-major, no security concern, clean single-line change).

Validation

- Confirmed via GitHub Releases API that `v7.0.1` is current (published 2026-07-20) and resolves to SHA `3d3c42e5aac5ba805825da76410c181273ba90b1`, matching the SHA already used elsewhere in the repo's compiled lock files.
- Scanned all `.github/workflows/*.md` and `*.yml` in the target repo for `uses:` pins; only this one stale pin found.
- Not validated: could not run `gh aw compile` to regenerate `manual-semver-release.lock.yml` — this control repo's local gh-aw CLI (v0.88.2) is older than its own required min-version (v0.88.4), and regenerating the target's lock file requires the target repo's own toolchain/CI.

Rollback guidance

Revert the single line change (`actions/checkout@v7.0.1` → `v7.0.0`) in `manual-semver-release.md` and re-run `gh aw compile` to restore the previous lock file.

A full review bundle (patch file, diff, validation notes) was published as a workflow artifact for this run.

### Control Plane
- Correlation ID: 33867912717-146
- Central repo: githubnext/gh-aw-cao
- Run URL: https://github.com/githubnext/gh-aw-cao/actions/runs/33867912717
- Target repository (review-only, not mutated): `githubnext/gh-aw-workshop`

> Generated by [:dependabot: Dependabot / Release Trains](https://github.com/githubnext/gh-aw-cao/actions/runs/33867912717) · copilot · auto · 56.7 AIC · ⌖ 8.15 AIC · ⊞ 20.5K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fdependabot-release-train-updater%22&type=issues)
>

_{Add this agentic workflow to your repo}

To install this agentic workflow, run

```
gh aw add githubnext/gh-aw-cao/.github/workflows/dependabot-release-train-updater.md@main
```

> - [x] expires on Sep 18, 2026, 11:39 AM UTC

In githubnext/gh-aw-workshop, update the checkout pin at line 123 of .github/workflows/manual-semver-release.md, then run gh aw compile to regenerate manual-semver-release.lock.yml. Confirm the compiled checkout step resolves to commit 3d3c42e5aac5ba805825da76410c181273ba90b1 and that CI passes; this requires write access to the target repository.

Written by the indexing model from the issue text.