ci(github-action): update action actions/checkout (9c091bb → 3d3c42e)

[its-miso]

This PR contains the following updates:

Package	Type	Update	Change
actions/checkout (changelog)	action	digest	9c091bb → 3d3c42e

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Configuration

📅 Schedule: (in timezone America/Edmonton)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[its-saffron]

AI Automated Review

Full PR review.

Analysis engine: MiniMax-M2.7@https://litellm.jory.dev/v1 (anthropic) — escalated (fast_low_confidence)

Recommendation: Approve

This is a routine Renovate digest update for actions/checkout — a standard dependency maintenance task with no risk.

Change Summary

• Updated files: .github/workflows/ci.yaml (4 occurrences) and .github/workflows/image.yaml (1 occurrence)
• Action updated: actions/checkout from commit 9c091bb → 3d3c42e
• Version preserved: Both old and new digests are pinned to v7 (confirmed by # v7 comments in diff)
• Net change: +5 lines, -5 lines — purely a SHA substitution

Standards Compliance

No repository standards conflict with this change. The AGENTS.md conventions cover application code, Prisma, API routes, and Docker. GitHub Actions digest pinning is not governed by a specific convention here. The practice of pinning actions to full commit SHAs (as opposed to version tags) is correct and already established in this repo — the previous digest 9c091bb was itself a SHA pin.

CI Results

All substantive CI checks passed for this commit:

• Build: ✅ success
• Typecheck: ✅ success
• Lint: ✅ success
• Tests: ✅ success
• Docker Build: ✅ success
• publish-release: ✅ success
• review (×8): ✅ success

The renovate/stability-days check remains pending, which is expected behavior for a Renovate PR and is non-blocking.

Repository Impact

The repository impact scan shows the old digest (9c091bb) still exists in 5 other workflow files (ai-pr-review.yaml, helm-lint.yaml, label-sync.yaml, manual-release.yml, publish-release.yml). This is expected — Renovate updates are scoped and do not cascade. Those files will be updated in separate PRs as Renovate processes them.

Conclusion

This PR is a safe, automated dependency update with no risk flags, no code changes, and passing CI. No blockers.