diff --git a/.github/workflows/_build.yml b/.github/workflows/_build.yml
index 152cca737..4579ee42a 100644
--- a/.github/workflows/_build.yml
+++ b/.github/workflows/_build.yml
@@ -108,7 +108,7 @@ jobs:
             release-candidates/${{ matrix.goos }}-${{ matrix.goarch }}/unstripped/*
             release-candidates/${{ matrix.goos }}-${{ matrix.goarch }}/THIRD_PARTY_NOTICES.md
 
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: release-candidates-${{ matrix.goos }}-${{ matrix.goarch }}
           path: release-candidates/${{ matrix.goos }}-${{ matrix.goarch }}
@@ -166,7 +166,7 @@ jobs:
             release-candidates/windows-amd64/unstripped/*
             release-candidates/windows-amd64/THIRD_PARTY_NOTICES.md
 
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: release-candidates-windows-amd64
           path: release-candidates/windows-amd64
@@ -228,7 +228,7 @@ jobs:
             release-candidates/windows-arm64/unstripped/*
             release-candidates/windows-arm64/THIRD_PARTY_NOTICES.md
 
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: release-candidates-windows-arm64
           path: release-candidates/windows-arm64
@@ -292,7 +292,7 @@ jobs:
             release-candidates/linux-${{ matrix.arch }}-portable/unstripped/*
             release-candidates/linux-${{ matrix.arch }}-portable/THIRD_PARTY_NOTICES.md
 
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: release-candidates-linux-${{ matrix.arch }}-portable
           path: release-candidates/linux-${{ matrix.arch }}-portable
@@ -446,7 +446,7 @@ jobs:
 
       - name: Preserve candidate selection evidence
         if: ${{ always() }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: release-selection-evidence
           path: selection-evidence
@@ -455,56 +455,56 @@ jobs:
       # Keep the established artifact names so the reusable smoke workflow and
       # all callers consume only the selected, byte-verified containers.
       - name: Upload linux-amd64 containers
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: binaries-linux-amd64
           path: release-containers/linux-amd64/*
           if-no-files-found: error
 
       - name: Upload linux-arm64 containers
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: binaries-linux-arm64
           path: release-containers/linux-arm64/*
           if-no-files-found: error
 
       - name: Upload linux-amd64-portable containers
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: binaries-linux-amd64-portable
           path: release-containers/linux-amd64-portable/*
           if-no-files-found: error
 
       - name: Upload linux-arm64-portable containers
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: binaries-linux-arm64-portable
           path: release-containers/linux-arm64-portable/*
           if-no-files-found: error
 
       - name: Upload darwin-amd64 containers
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: binaries-darwin-amd64
           path: release-containers/darwin-amd64/*
           if-no-files-found: error
 
       - name: Upload darwin-arm64 containers
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: binaries-darwin-arm64
           path: release-containers/darwin-arm64/*
           if-no-files-found: error
 
       - name: Upload windows-amd64 containers
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: binaries-windows-amd64
           path: release-containers/windows-amd64/*
           if-no-files-found: error
 
       - name: Upload windows-arm64 containers
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: binaries-windows-arm64
           path: release-containers/windows-arm64/*
diff --git a/.github/workflows/_memwaste.yml b/.github/workflows/_memwaste.yml
index 72701ca7a..d08b1692b 100644
--- a/.github/workflows/_memwaste.yml
+++ b/.github/workflows/_memwaste.yml
@@ -52,7 +52,7 @@ jobs:
         run: python3 scripts/memwaste-ratchet.py --out "$RUNNER_TEMP/memwaste-event" --venue ${{ inputs.mode }}-linux
       - name: Upload report
         if: ${{ always() }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: memwaste-event-linux-${{ inputs.mode }}
           path: |
@@ -82,7 +82,7 @@ jobs:
             --out "$RUNNER_TEMP/memwaste-scaling" | tee "$RUNNER_TEMP/memwaste-scaling/report.txt"
       - name: Upload report
         if: ${{ always() }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: memwaste-scaling-linux-${{ inputs.mode }}
           path: ${{ runner.temp }}/memwaste-scaling/report.txt
@@ -108,7 +108,7 @@ jobs:
             --out "$RUNNER_TEMP/memwaste-access" | tee "$RUNNER_TEMP/memwaste-access/report.txt"
       - name: Upload report
         if: ${{ always() }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: memwaste-access-linux-${{ inputs.mode }}
           path: |
@@ -135,7 +135,7 @@ jobs:
         run: python3 scripts/memwaste-ratchet.py --out "$RUNNER_TEMP/memwaste-event" --venue full-macos
       - name: Upload report
         if: ${{ always() }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: memwaste-event-macos-${{ inputs.mode }}
           path: |
@@ -177,7 +177,7 @@ jobs:
         run: python3 scripts/memwaste-ratchet.py --out "$(cygpath -u "$RUNNER_TEMP")/memwaste-event" --venue full-windows
       - name: Upload report
         if: ${{ always() }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: memwaste-event-windows-${{ inputs.mode }}
           path: |
diff --git a/.github/workflows/_soak.yml b/.github/workflows/_soak.yml
index 39f9e76b1..5a6f0e9c7 100644
--- a/.github/workflows/_soak.yml
+++ b/.github/workflows/_soak.yml
@@ -98,14 +98,14 @@ jobs:
           scripts/soak-legs.sh --legs "${{ inputs.legs }}" "$binary" ${{ inputs.duration_minutes }}
       - name: Upload metrics
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: soak-quick-${{ matrix.goos }}-${{ matrix.goarch }}
           path: soak-results/
           retention-days: 14
       - name: Upload query-leak metrics
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: soak-query-leak-${{ matrix.goos }}-${{ matrix.goarch }}
           path: soak-results-query-leak/
@@ -175,14 +175,14 @@ jobs:
           scripts/soak-legs.sh --legs "${{ inputs.legs }}" "$binary" ${{ inputs.duration_minutes }}
       - name: Upload metrics
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: soak-quick-windows-amd64
           path: soak-results/
           retention-days: 14
       - name: Upload query-leak metrics
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: soak-query-leak-windows-amd64
           path: soak-results-query-leak/
@@ -253,14 +253,14 @@ jobs:
           scripts/soak-legs.sh --legs "${{ inputs.legs }}" "$binary" ${{ inputs.duration_minutes }}
       - name: Upload metrics
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: soak-quick-windows-arm64
           path: soak-results/
           retention-days: 14
       - name: Upload query-leak metrics
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: soak-query-leak-windows-arm64
           path: soak-results-query-leak/
@@ -305,14 +305,14 @@ jobs:
             ${{ inputs.duration_minutes }}
       - name: Upload metrics
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: soak-quick-linux-${{ matrix.arch }}-portable
           path: soak-results/
           retention-days: 14
       - name: Upload query-leak metrics
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: soak-query-leak-linux-${{ matrix.arch }}-portable
           path: soak-results-query-leak/
@@ -373,7 +373,7 @@ jobs:
         run: scripts/soak-legs.sh --legs quick build/c/codebase-memory-mcp 15
       - name: Upload metrics
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: soak-asan-${{ matrix.goos }}-${{ matrix.goarch }}
           path: soak-results/
@@ -413,7 +413,7 @@ jobs:
         run: scripts/soak-legs.sh --legs quick build/c/codebase-memory-mcp 15
       - name: Upload metrics
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: soak-asan-windows-amd64
           path: soak-results/
diff --git a/.github/workflows/_test.yml b/.github/workflows/_test.yml
index 501a82b20..ff378b1d0 100644
--- a/.github/workflows/_test.yml
+++ b/.github/workflows/_test.yml
@@ -253,7 +253,7 @@ jobs:
       # too keeps red iterations warm.
       - name: Shard manifest (completeness proof)
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: shard-manifest-${{ matrix.os }}-${{ matrix.cc }}-${{ strategy.job-index }}
           path: build/c/test-logs/shard-manifest.txt
@@ -274,7 +274,7 @@ jobs:
       # directory, and a second error would only bury the first.
       - name: Failing suite logs
         if: failure()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: suite-logs-${{ matrix.os }}-${{ matrix.cc }}-${{ strategy.job-index }}
           path: build/c/test-logs/failed/
@@ -406,7 +406,7 @@ jobs:
       # not end green, only when the job failed.
       - name: Failing suite logs
         if: failure()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: suite-logs-diag
           path: build/c/test-logs/failed/
@@ -504,7 +504,7 @@ jobs:
       # not end green, only when the job failed.
       - name: Failing suite logs
         if: failure()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: suite-logs-lsan-macos
           path: build/c/test-logs/failed/
@@ -669,7 +669,7 @@ jobs:
 
       - name: Shard manifest (completeness proof)
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: shard-manifest-${{ matrix.os }}-${{ matrix.msystem }}-${{ strategy.job-index }}
           path: build/c/test-logs/shard-manifest.txt
@@ -684,7 +684,7 @@ jobs:
       # not end green, only when the job failed.
       - name: Failing suite logs
         if: failure()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: suite-logs-${{ matrix.os }}-${{ matrix.msystem }}-${{ strategy.job-index }}
           path: build/c/test-logs/failed/
diff --git a/.github/workflows/dry-run.yml b/.github/workflows/dry-run.yml
index c582716fe..7554f16fb 100644
--- a/.github/workflows/dry-run.yml
+++ b/.github/workflows/dry-run.yml
@@ -148,7 +148,7 @@ jobs:
         run: scripts/fuzz.sh all --runs 20000 --seed 1
       - name: Upload reproducers
         if: ${{ failure() }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: fuzz-artifacts
           path: build/fuzz/artifacts-*/
diff --git a/.github/workflows/nightly-soak.yml b/.github/workflows/nightly-soak.yml
index d4357aad6..e45d3395f 100644
--- a/.github/workflows/nightly-soak.yml
+++ b/.github/workflows/nightly-soak.yml
@@ -51,7 +51,7 @@ jobs:
         run: scripts/fuzz.sh all --max-total-time 1800 --seed 0
       - name: Upload reproducers
         if: ${{ failure() }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: fuzz-artifacts-nightly
           path: build/fuzz/artifacts-*/
diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
index e20ac274a..2c59a4db2 100644
--- a/.github/workflows/pr.yml
+++ b/.github/workflows/pr.yml
@@ -78,7 +78,7 @@ jobs:
         run: scripts/ci/test-impact-select.sh --binary build/c/codebase-memory-mcp --out "$RUNNER_TEMP/test-impact" --gate "$RUNNER_TEMP/test-selection"
       - name: Upload the selection
         if: ${{ steps.select.outputs.selection == 'narrowed' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: test-selection
           path: ${{ runner.temp }}/test-selection
@@ -88,7 +88,7 @@ jobs:
       # for the vetoes, never read by a test leg.
       - name: Upload the vetoed selection
         if: ${{ !cancelled() && steps.select.outcome != 'skipped' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: test-selection-vetoed
           path: ${{ runner.temp }}/test-impact/selection-vetoed.json
@@ -342,7 +342,7 @@ jobs:
         run: scripts/ci/test-impact-select.sh --binary build/c/codebase-memory-mcp --out "$RUNNER_TEMP/test-impact"
       - name: Upload the prediction
         if: ${{ always() }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: test-impact-prediction
           path: |
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index e4926260d..033c1a14b 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -236,7 +236,7 @@ jobs:
       # same-run workflow artifact, not a draft-release download, so that
       # job keeps contents: read and no gh dependency.
       - name: Preserve checksums for the registry job
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: release-checksums
           path: checksums.txt
@@ -429,7 +429,7 @@ jobs:
 
       - name: Preserve extracted-object VirusTotal evidence
         if: ${{ always() }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: virustotal-evidence-release-${{ github.run_id }}
           path: |
diff --git a/.github/workflows/test-impact-artifact.yml b/.github/workflows/test-impact-artifact.yml
index 49f70dd67..a0a53061c 100644
--- a/.github/workflows/test-impact-artifact.yml
+++ b/.github/workflows/test-impact-artifact.yml
@@ -79,7 +79,7 @@ jobs:
             --out "$RUNNER_TEMP/bundle" --mode "$mode" --before "$before"
 
       - name: Upload the bundle
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: test-impact-${{ github.sha }}
           path: ${{ runner.temp }}/bundle