chore(deps): apply Dependabot bumps for actions and Python requirements

[TMHSDigital]

Consolidates the eight open Dependabot PRs into one change:

• actions/setup-python v6 -> v7 in workflows, composite actions, scaffold templates, and ACTION_PINS (the removed pip-install input was not used anywhere)
• actions/stale v10 -> v11 in the workflow, scaffold template, and ACTION_PINS
• Jinja2 >=3.1.6, PyYAML >=6.0.3, pytest >=9.1.1,<10.0

The Dependabot PRs were opened before the docs-hygiene test fix on main, and the action bumps need the scaffold pin table updated in the same change (the workflow-hygiene test enforces it). Local run: 352 passed, 2 skipped on pytest 9.1.1; registry sync ok.

Supersedes #136, #137, #138, #139, #140, #141, #142, #143.

🤖 Generated with Claude Code

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ⚠️ 1 package(s) with unknown licenses.

See the Details below.

License Issues

.github/workflows/validate.yml

Package	Version	License	Issue Type
actions/setup-python	7.*.*	Null	Unknown License

OpenSSF Scorecard

Package	Version	Score	Details
actions/actions/setup-python	7.*.*	🟢 6.6	Details Check Score Reason Maintained 🟢 10 17 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 Binary-Artifacts 🟢 10 no binaries found in the repo Code-Review 🟢 10 all changesets reviewed Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Packaging ⚠️ -1 packaging workflow not detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies 🟢 7 dependency not pinned by hash detected -- score normalized to 7 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Security-Policy 🟢 9 security policy file detected Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches SAST 🟢 9 SAST tool is not run on all commits -- score normalized to 9
pip/Jinja2	>= 3.1.6,< 4.0	Unknown	Unknown
pip/Jinja2	>= 3.1.6,< 4.0	Unknown	Unknown

Scanned Files

• .github/workflows/validate.yml
• requirements.txt
• site-template/requirements.txt

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pypi/​pytest@​8.4.2 ⏵ 9.1.1	-3	+2

View full report