publish.yml checkout@v7 parity

Trap: upgrading only ci-poller.yml to actions/checkout@v7 looks scoped because it is under direct review, but Publish also checks out its controller and CI-approved target repository. Fix: use actions/checkout@v7 for all required Publish checkouts and assert versions in workflow tests; preserve unrelated workflow versions unless their scope independently requires an upgrade.