ci(deps): bump checkout & codecov to v7, target dependabot at dev

Applies Dependabot's actions/checkout v6->v7 and codecov-action v6->v7, and adds
target-branch: dev so future bumps land on the work branch and reach main/next
via the normal release fast-forward — instead of opening PRs against main, which
would diverge main from dev.

Author: iserdmi

.github/dependabot.yml

@@ -2,8 +2,10 @@
 # Grouped + weekly so it's at most a couple of PRs per week, not noise.
 version: 2
 updates:
+  # Target dev, not default-branch main: bumps reach main/next via the release fast-forward (keeps main a ff of dev).
   - package-ecosystem: npm
     directory: '/'
+    target-branch: 'dev'
     schedule:
       interval: weekly
     open-pull-requests-limit: 5
@@ -21,6 +23,7 @@ updates:
 
   - package-ecosystem: github-actions
     directory: '/'
+    target-branch: 'dev'
     schedule:
       interval: weekly
     groups:

.github/workflows/ci.yml

@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Setup Node.js 22
         uses: actions/setup-node@v6
@@ -44,7 +44,7 @@ jobs:
         run: bun test ./src --coverage --coverage-reporter=text --coverage-reporter=lcov
 
       - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@v6
+        uses: codecov/codecov-action@v7
         with:
           files: ./coverage/lcov.info
           slug: 1gr14/error0
@@ -104,7 +104,7 @@ jobs:
       github.event_name != 'pull_request' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/next')
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Setup Node.js
         uses: actions/setup-node@v6