ci(deps): adopt the open dependabot bumps (PRs #17, #13)

Applied here rather than merging the PRs, because both targeted the pre-split
main and would not replay onto the JS-only history.

GitHub Actions (#17):
  actions/checkout          v6.0.3  -> v7.0.1
  github/codeql-action/*    v4.36.2 -> v4.37.3
  ossf/scorecard-action     v2.4.3  -> v2.4.4
  softprops/action-gh-release        pinned SHA refresh (v3)

Dev dependency (#13):
  typescript                ^6.0.3  -> ^7.0.2

TypeScript 7 is a major bump, so it was gated on the real check rather than
assumed: `tsc --noEmit` (v7.0.2) is clean across the checkJs surface, biome
lint is clean over 569 files, `bun audit` reports no vulnerabilities, and the
suite is 2478 pass / 0 fail.