[dependabot]

Updates the pinned actions/download-artifact action from v4 to v7 in .github/workflows/ci.yml and .github/workflows/release.yml; this moves artifact download onto the current action major line. No application source changes are included.

Canonical requirement

• Canonical Issue URL: chore(governance): enforce revisioned Issue requirements and acceptance ledgers #95
• Consumed revision: R1
• No automatic close keywords: acknowledged

Delivery ownership

• implementationOwner: @dependabot
• automatedPreReviewOwner: Dependabot compatibility and hosted CI
• humanReviewOwner: @PeterGuy326
• Separation of duties: the bot authors the dependency update; a non-author human reviewer owns the final review.

Requirement trace

REQ/AC IDs	Changed files / domain	Tests or review evidence
REQ-379 / AC-379	the pinned actions/download-artifact action v4 to v7 update in .github/workflows/ci.yml and .github/workflows/release.yml	Hosted Node 20/22/24 CI, coverage, package-consumer, container, distribution, dependency review, CodeQL, and security checks on the exact PR head

File domains

• the pinned actions/download-artifact action v4 to v7 update in .github/workflows/ci.yml and .github/workflows/release.yml; no application runtime source is changed.

Scope and non-goals

This PR updates only the the pinned actions/download-artifact action pinned action version in .github/workflows/ci.yml and .github/workflows/release.yml. It does not change product behavior, APIs, data formats, or release policy beyond the stated dependency/action update.

Validation

• Exact commands: hosted workflow command npm test; governance command npm run governance:check -- --github-event-file "$GITHUB_EVENT_PATH".
• Observed counts/results: NOT VERIFIED: hosted checks will be rerun after this PR trace is restored.
• Check URLs: https://github.com/bytefolk/digital-employee/pull/379/checks

ID	REQ/AC	Observable acceptance criterion	Command or manual steps	Environment	Expected	Observed	Status
V1	AC-379	Dependency and workflow files resolve across supported Node versions.	Hosted GitHub Actions CI matrix	Node 20, 22, and 24 GitHub-hosted runners	Required checks pass on exact head.	NOT VERIFIED: hosted checks will be rerun after this body update.	NOT VERIFIED

Security and compatibility

The change is a major-version pin update of the GitHub-hosted artifact download action used by CI and release workflows; application code and workflow permissions are unchanged, and artifact download usage is unchanged. Hosted dependency review and the supported Node-version matrix remain required.

Known limitations

The governance-only failed jobs must be rerun after restoring this body. No local result substitutes for required hosted checks.

Risk and rollback

Risk is limited to CI artifact download compatibility. Rollback is the two-file workflow pin revert; there is no data migration or irreversible side effect.

Product review handoff

• Automated pre-review result: PASS: Dependabot generated a dependency-only update.
• Human final review: PENDING
• Merge ledger owner: @PeterGuy326
• Product reviewer: @PeterGuy326
• Milestone or release packet: N/A: dependency maintenance PR; no separate product packet.
• Merge, CI, release, and model judgment do not accept or close the Issue: acknowledged