fix: restore matrix example and update actions

[sbroenne]

Summary

• Add the missing Copilot model × system prompt matrix integration test
• Replace stale Pydantic links with the complete current Copilot example index
• Update checkout to 7.0.1, CodeQL to 4.37.6, and PyPI publish to 1.14.2
• Supersede Dependabot PRs chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 #61, chore(deps): bump github/codeql-action/init from 4.37.0 to 4.37.4 #65, chore(deps): bump github/codeql-action/analyze from 4.37.0 to 4.37.4 #66, chore(deps): bump pypa/gh-action-pypi-publish from 1.14.0 to 1.14.2 #67, and chore(deps): bump github/codeql-action/autobuild from 4.37.0 to 4.37.4 #68

Validation

• uv run ruff check src tests
• uv run pyright
• uv run python -m pytest tests/integration/copilot/test_04_matrix.py -q — 4 passed
• uv run python -m pytest tests/integration/copilot/test_01_basic.py -q — 4 passed

Closes #74
Closes #75

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
actions/actions/checkout	3d3c42e5aac5ba805825da76410c181273ba90b1	🟢 6.9	Details Check Score Reason Binary-Artifacts 🟢 10 no binaries found in the repo Code-Review 🟢 10 all changesets reviewed Maintained 🟢 10 24 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed Packaging ⚠️ -1 packaging workflow not detected License 🟢 10 license file detected Pinned-Dependencies 🟢 3 dependency not pinned by hash detected -- score normalized to 3 Signed-Releases ⚠️ -1 no releases found Security-Policy 🟢 9 security policy file detected SAST 🟢 10 SAST tool is run on all commits Branch-Protection 🟢 5 branch protection is not maximal on development and all release branches
actions/actions/checkout	3d3c42e5aac5ba805825da76410c181273ba90b1	🟢 6.9	Details Check Score Reason Binary-Artifacts 🟢 10 no binaries found in the repo Code-Review 🟢 10 all changesets reviewed Maintained 🟢 10 24 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed Packaging ⚠️ -1 packaging workflow not detected License 🟢 10 license file detected Pinned-Dependencies 🟢 3 dependency not pinned by hash detected -- score normalized to 3 Signed-Releases ⚠️ -1 no releases found Security-Policy 🟢 9 security policy file detected SAST 🟢 10 SAST tool is run on all commits Branch-Protection 🟢 5 branch protection is not maximal on development and all release branches
actions/pypa/gh-action-pypi-publish	dc37677b2e1c63e2034f94d8a5b11f265b73ba33	🟢 5.7	Details Check Score Reason Security-Policy 🟢 4 security policy file detected Binary-Artifacts 🟢 10 no binaries found in the repo Maintained 🟢 10 6 commit(s) and 8 issue activity found in the last 90 days -- score normalized to 10 Code-Review 🟢 4 Found 9/19 approved changesets -- score normalized to 4 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Pinned-Dependencies ⚠️ 1 dependency not pinned by hash detected -- score normalized to 1 Signed-Releases ⚠️ -1 no releases found Branch-Protection 🟢 3 branch protection is not maximal on development and all release branches Packaging 🟢 10 packaging workflow detected SAST 🟢 8 SAST tool is not run on all commits -- score normalized to 8

Scanned Files

• .github/workflows/hero-tests.yml
• .github/workflows/release.yml