chore(deps): bump the github-actions group across 1 directory with 2 updates - #3141

Advisory evidence only. This check never authorizes implementation or merge.

State: private-tracking-manual-review. Security/dependency coordination may use private tracking. Confirm privately; do not publish confidential links.

A current comment scan cannot detect a deleted withdrawal. Confirm current bounded scope,
implementation-to-scope match and review support with a responsible human.
Use CONTRIBUTING.md and the trusted default-branch GOVERNANCE.md roster.
Private security tracking stays private. No labels, milestones or code reviews substitute for scope approval.