Feature: freshness indicator + one-click bump for outdated uses: action versions

まず、拡張機能で既に使われている箇所を追跡します。解決処理と認証済みのアクションメタデータ呼び出し、および #592 と #593 の関連作業が対象です。freshness の結果、CodeLens、Quick Fix の動作、24 時間のキャッシュ、github-actions.versionCheck 設定がそのパイプラインにどう組み込まれるかを定義します。完了の条件は、古くなった refs がインラインで表示され、設定された pin スタイルを維持したまま更新できることです。

Summary

The extension already resolves uses: owner/repo@ref for validation. It does not surface whether the pinned ref is the latest.

Effect: workflows quietly drift onto EOL action majors (e.g. actions/checkout@v3 after v4 is default, actions/upload-artifact@v3 after the v3 sunset). Users only notice on a deprecation warning in a run log, weeks later.

Proposal

For each uses: line:

1. On workflow open, resolve the pinned ref against the action's releases (already an authenticated call the extension can make).
2. If a newer major/minor exists, render a subtle CodeLens above the line: v3 -> v4 available (published 3 months ago).
3. Clicking the CodeLens offers a Quick Fix: rewrite @v3 to @v4 (or @<sha> # v4.1.7 if the current pin is a SHA, preserving the pin style).
4. Results cached per-action for 24h to avoid API-limit churn. Setting: github-actions.versionCheck.enabled (default: on) + github-actions.versionCheck.pinStyle (tag | sha | preserve, default preserve).

Why this belongs in the extension

Dependabot handles it eventually, but only after a PR round-trip. Renovate/Dependabot are async, this is inline. Same latency benefit as npm-outdated inline hints in the JS ecosystem.

Non-goals

• Not a security scanner (that is dependabot / gh actions-secure territory).
• Not automated PR opening.

Related

• #592 (autocomplete for action inputs) - same "we already have action metadata loaded" muscle
• #593 (commit-pinned unresolved) - same resolution pipeline