[dependabot:release-train-updater] Review bundle: bump stale GitHub Actions pins in gh-aw-threat-detection

**Target repository:** `github/gh-aw-threat-detection`
**Mode:** review (artifact-backed bundle; no direct write access to the target repo in this run)

## Summary
Found 4 stale SHA-pinned GitHub Actions references across 4 CI workflow files (none are `.lock.yml`-generated, so no `gh aw compile` is required):

| File | Action | Old | New |
|---|---|---|---|
| `.github/workflows/ci.yml` | `actions/checkout` (smoke job) | v6.0.2 | v7.0.1 |
| `.github/workflows/license-check.yml` | `actions/checkout` | v6.0.2 | v7.0.1 |
| `.github/workflows/license-check.yml` | `actions/setup-go` | v5.2.0 | v7.0.0 |
| `.github/workflows/license-check.yml` | `actions/upload-artifact` | v4.6.0 | v7.0.1 |
| `.github/workflows/gh-aw-version-check.yml` | `actions/checkout` | v6.0.2 | v7.0.1 |
| `.github/workflows/release-platform-parity.yml` | `actions/checkout` | v6.0.2 | v7.0.1 |

Scope: CI/build tooling only — no Go module dependencies exist yet (`go.mod` declares only the module with no requires), no runtime/auth/crypto code touched, no open Dependabot alerts or existing dependency PRs found.

**Action:** A maintainer with write access to `github/gh-aw-threat-detection` should apply the attached patch, run CI on the change, and merge if green.

Agent prompt

Apply the proposed patch bumping `actions/checkout`, `actions/setup-go`, and `actions/upload-artifact` pinned SHAs to their latest released versions in `.github/workflows/ci.yml`, `license-check.yml`, `gh-aw-version-check.yml`, and `release-platform-parity.yml`. Open a PR, verify CI passes, and merge.

Full details, diff, and validation notes

See the published review-bundle artifact `gh-aw-threat-detection-actions-pins` for `summary.md`, `proposed.patch`, `changed-files.txt`, and `validation.txt`.

No build/test commands were run against the target repo in this review-mode run (no write access); recommend running CI once the patch is applied.

### Control Plane
- Correlation ID: 33899910072-44
- Central repo: githubnext/gh-aw-cao
- Run URL: https://github.com/githubnext/gh-aw-cao/actions/runs/33899910072

> Generated by [:dependabot: Dependabot / Release Trains](https://github.com/githubnext/gh-aw-cao/actions/runs/33900244544) · copilot · auto · 83.9 AIC · ⌖ 11 AIC · ⊞ 20.5K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fdependabot-release-train-updater%22&type=issues)
>

_{Add this agentic workflow to your repo}

To install this agentic workflow, run

```
gh aw add githubnext/gh-aw-cao/.github/workflows/dependabot-release-train-updater.md@main
```

> - [x] expires on Sep 18, 2026, 5:32 PM UTC

Start with the published gh-aw-threat-detection-actions-pins artifact and its proposed.patch, then inspect .github/workflows/ci.yml, license-check.yml, gh-aw-version-check.yml, and release-platform-parity.yml. Apply the listed GitHub Actions SHA updates in the target repository and run CI; done means the workflow checks pass and a maintainer can merge the change.

Written by the indexing model from the issue text.