fix: update third-party GitHub Actions

[PierreJeanjacquot]

GitHub Actions upgrades

propose-safe-multisig-tx

Action	Initial version	Updated version	Breaking changes
actions/checkout	v4.4.0	v7.0.1	Spans 3 majors. v5.0.0: Node 24 runtime, requires runner ≥ v2.327.1. v6.0.0: credentials are persisted to a separate file. v7.0.0: migrated to ESM + blocks checking out a fork PR on pull_request_target and workflow_run (allow-unsafe-pr-checkout needed to restore the previous behaviour).
actions/setup-node	v4.4.0	v7.0.0	Spans 3 majors. v5.0.0: Node 24 runtime (runner ≥ v2.327.1) + automatic caching enabled whenever package.json has a packageManager field (opt out with package-manager-cache: false). v6.0.0: automatic caching restricted to npm only. v7.0.0: migrated to ESM, removed the dummy NODE_AUTH_TOKEN export, added cache-primary-key / cache-matched-key outputs.

docker-build-cloud

Action	Initial version	Updated version	Breaking changes
actions/checkout	v6.1.0	v7.0.1	v7.0.0: migrated to ESM + blocks checking out a fork PR on pull_request_target and workflow_run. The allow-unsafe-pr-checkout input already exists in v6.1.0, so no interface change.
docker/setup-buildx-action	v4.3.0	v4.4.1	None. Minor + patch: official Buildx releases for the cloud driver, BuildKit image pre-pull (skipped for explicit endpoints in v4.4.1), dependency bumps.
docker/build-push-action	v7.3.0	v7.4.0	None. Minor: fix for workflow command injection in metadata logs, @docker/actions-toolkit 0.92.0 → 0.100.0.
actions/attest	v4.1.1	v4.2.2	None. Minor + patches: SHA-2 subject digest support, subjects read from GITHUB_ARTIFACTS_LIST, cross-OS checksum parsing, OCI tag stripped when pushing the attestation.

java-build

Action	Initial version	Updated version	Breaking changes
actions/checkout	v6.1.0	v7.0.1	v7.0.0: migrated to ESM + blocks checking out a fork PR on pull_request_target and workflow_run.

rust-build

Action	Initial version	Updated version	Breaking changes
actions/checkout	v6.1.0	v7.0.1	v7.0.0: migrated to ESM + blocks checking out a fork PR on pull_request_target and workflow_run.
actions/cache	v5.1.0	v6.1.0	v6.0.0: CommonJS → ESM migration (no documented input/output change). v6.1.0: @actions/cache v6.1.0, handles read-only cache access.
dtolnay/rust-toolchain	master @ 2026-09-04	master @ 2026-09-12	None — the repo publishes no releases, the pin tracks the master branch. Check the commit log over that window.

---

Cross-cutting things to watch

• actions/checkout v7: any pull_request_target or workflow_run workflow that checks out the fork PR code will break without allow-unsafe-pr-checkout: true. This is the only genuinely risky breaking change in this batch.
• actions/checkout / actions/setup-node v5+: Node 24 runtime, so self-hosted runners must be ≥ v2.327.1.
• actions/setup-node v6: any job relying on automatic caching for yarn/pnpm now has to configure cache: explicitly.
• gradle/actions v6.4.0: add the Gradle signing key if dependency verification is enabled.

Excluded

gradle/actions/setup-gradle update from v6.3.0 to v6.4.0 is excluded from this fix update on purpose: the Gradle signing key rotation may be breaking; this requires further investigations.