build: refresh pinned GitHub Actions

[saagpatel]

Summary

Refreshes the pinned GitHub Actions dependency set that was opened separately by Dependabot, and updates MCPAudit's explicit reviewed-action allowlist so CI continues to enforce immutable action pins.

This supersedes Dependabot PRs #172, #173, and #174 with one aggregate reviewable change.

Changes

• Updates astral-sh/setup-uv from v7.6.0 to v8.3.2 in CI and publish workflows.
• Updates publish artifact upload/download actions to actions/[email protected] and actions/[email protected].
• Updates tests/test_supply_chain_policy.py with the reviewed release tag commits for those three actions.

Checklist

• Canonical verifier passes (uv run pytest, uv run ruff check, uv run mypy .)
• Security implications considered — does this change affect risk scoring, threat detection, config parsing, or output that feeds into AI systems? If yes, describe the implications below.
• CHANGELOG.md updated under [Unreleased]
• New or changed behavior is documented (README, docstrings, or both)

Security implications

This is supply-chain hardening for GitHub Actions dependency freshness. It does not change MCPAudit detection, risk scoring, config parsing, reports, or LLM-facing output.

The changed actions remain pinned to immutable commit SHAs, and those SHAs were read back from the upstream release tags before opening this PR:

• astral-sh/[email protected] -> 11f9893b081a58869d3b5fccaea48c9e9e46f990
• actions/[email protected] -> 043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
• actions/[email protected] -> 3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c

Test plan

• uv run pytest tests/test_supply_chain_policy.py -q -> 2 passed
• uv run pytest -q -> 1052 passed
• uv run ruff check . -> pass
• uv run ruff format --check . -> pass, 112 files already formatted
• uv run mypy . -> pass, no issues in 112 source files
• uv lock --check -> pass
• git diff --check -> pass
• Upstream release tag readback for all three changed actions matched the committed SHAs.

Related issues

Supersedes #172, #173, and #174.

[github-actions]

Agent Permission Diff

• Base: ec176b4a6b2f2837c89885a48a676a8fd5cfc189
• Head: 14fa8d60384d373e0e73098c8acb60c82b1fe270
• Findings: 0
• Gate findings: 0
• Acknowledged findings: 0
• Permission changes: 0
• Gate: pass in observe mode
• Fail on: critical
• Exit code: 0

Gate Decision

No findings were produced.

Findings

No agent-facing permission findings.