build(deps): update GitHub Actions and migrate pnpm setup

[ImLunaHey]

Summary

• bump actions/checkout from v6 to v7
• bump actions/setup-go from v6 to v7
• replace pnpm/action-setup v5 with the successor pnpm/setup v2
• use pnpm/setup for pnpm 11.22, Node 24, and caching in CI
• preserve actions/setup-node in the release job for npm registry configuration

Validation

• verified all referenced action tags exist upstream
• passed the pnpm 11.22 frozen-lockfile install, formatting check, and type check
• passed actionlint with known pre-existing custom-runner and untouched legacy-command diagnostics excluded
• parsed all workflow YAML files successfully
• passed git diff --check
• completed a supply-chain and credential-boundary review with no new high or medium findings

---

Note

Medium Risk
Touches CI and release workflows (including npm publish setup). Risk is mainly pipeline breakage if the new action versions or pnpm/setup inputs misbehave; no application or auth logic changes.

Overview
Bumps CI/release GitHub Actions and consolidates Node/pnpm setup.

actions/checkout and actions/setup-go move from v6 to v7 across ci.yml, release.yml, and claude.yml. Lint and build jobs replace pnpm/action-setup plus actions/setup-node with a single pnpm/setup@v2 step that installs pnpm 11.22, Node 24, and cache (with install: false so deps still install via frozen lockfile). The release job still uses setup-node for the npm registry URL.

^{Reviewed by Cursor Bugbot for commit 7e1d64e. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 25e2267. Configure here.}

[cursor]

Stale comment

Risk: medium. Left a non-blocking comment; no reviewers were assigned. Cursor Bugbot and Cursor Security Agent were still in progress after the wait window, so this run cannot approve and human review is needed.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

[cursor]

Stale comment

Risk: medium. Left a non-blocking comment; no reviewers were assigned. Cursor Security Agent: Security Reviewer did not reach a terminal state within the wait window, so this run cannot approve and human review is needed.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

[cursor]

Risk: medium. Left a non-blocking comment; no reviewers were assigned. Cursor Security Agent: Security Reviewer did not reach a terminal state within the wait window, so this run cannot approve and human review is needed.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}