chore: bump actions/setup-node and actions/cache pins in setup composite action

[pinecone-groundskeeper]

Problem

.github/actions/setup/action.yml — the shared composite "Setup" action used by every job in validate.yml and regularCheck.yml — pinned actions/setup-node@v4 (3 majors behind v7) and actions/cache@v4 (2 majors behind v6). Dependabot's github-actions ecosystem updater only scans uses: pins inside .github/workflows/*.yml, not composite action definitions under .github/actions/**, so these two pins were a blind spot never touched by the two currently-open Dependabot PRs (#71 bumps actions/cache only inside the two workflow files; #72 bumps actions/checkout only inside the two workflow files).

Solution

Bump both pins in .github/actions/setup/action.yml to their current major release, confirmed via the GitHub releases API:

• actions/setup-node@v4 → actions/setup-node@v7 (latest: v7.0.0)
• actions/cache@v4 → actions/cache@v6 (latest: v6.1.0)

No other files changed — the actions/cache@v4 pins inside regularCheck.yml/validate.yml's "Cache embedding model" steps are already covered by open PR #71 and are out of scope here, as is actions/checkout (PR #72).

Verification

This is a pin-only change with no application code touched. npm ci in this sandbox fails on an unrelated, pre-existing issue (onnxruntime-node's postinstall script needs api.nuget.org, which the sandbox network doesn't allow), so I could not run npm run test/lint/typecheck locally end-to-end. I did confirm:

• The YAML is well-formed and the only lines changed are the two uses: pins.
• v7.0.0 and v6.1.0 are genuinely the latest releases of actions/setup-node and actions/cache respectively (checked via the GitHub releases API).

This PR's own CI run of validate.yml/regularCheck.yml (which consume this composite action via uses: ./.github/actions/setup) is the real verification that npm ci, typecheck, lint, format check, and npm run test still pass — please check that the checks are green before merging, since I could not confirm it locally.

Closes #83

Generated by GitHub Maintenance Fixer · sonnet50 · 58.2 AIC · ⌖ 15.6 AIC · ⊞ 9.4K · ◷

---

Note

Low Risk
Pin-only CI dependency updates with no application or auth changes. Residual risk is a possible cache/setup-node behavior change on CI until the workflows run green.

Overview
Bumps GitHub Action majors in the shared composite Setup action used by validate.yml and regularCheck.yml: actions/setup-node from v4 to v7 and actions/cache from v4 to v6.

No workflow or application logic changes. Workflow-level actions/cache pins for the embedding-model cache remain at v4.

^{Reviewed by Cursor Bugbot for commit 1d36161. Bugbot is set up for automated code reviews on this repo. Configure here.}