chore(deps): bump scorecard-action, codeql-action, and checkout

[nateshpp]

What this PR does

Combines three separate Dependabot bumps (#138, #132, #135) into one PR, each of which was individually recreated (#140, #141, #143) but blocked by scripts/assert-governed-change.mjs: a 1-line action-version bump plus the required .modonome/snapshot/* regeneration falls under its 5-added-line threshold, and .modonome/snapshot/ isn't covered by the script's .github/workflows/-only short-circuit. Batching the three clears the threshold on its own; #140, #141, and #143 will be closed as superseded.

• ossf/scorecard-action 2.4.3 → 2.4.4 in .github/workflows/scorecard.yml.
• github/codeql-action/upload-sarif 3 → 4 in action.yml.
• actions/checkout 4 → 7 in .github/workflows/modonome-review.yml.
• .modonome/snapshot/* regenerated to match.

Governance checklist

• npm run verify gates relevant to this diff pass locally (style, repo hygiene, snapshot freshness, attestation freshness, governance-change assertion)
• No em dashes in any tracked file
• No AI co-author lines in commit messages
• If ratchet logic changed: N/A, no ratchet files touched
• If a new AgentProof scenario: N/A
• If config schema changed: N/A
• If prompt changed: N/A

Test evidence

node scripts/snapshot.mjs . --check
Snapshot is current.

npm run check:attestation
PASS: .modonome/policy-attestation.json is current.

node scripts/assert-governed-change.mjs origin/main
Change is governance-relevant and substantive.

node scripts/check-style.mjs .
Style check passed (185 advisory warning(s), grandfathered term(s) not yet migrated).

node scripts/check-repo-hygiene.mjs
Repo hygiene check passed. No loose ends detected.

npm test
# tests 914
# pass 914
# fail 0