ci: bump actions to v7 and add package-lock.json

setup-node with cache: npm requires a lock file; the initial run
failed with 'Dependencies lock file is not found'. Committing the
generated package-lock.json and updating checkout/setup-node to the
latest v7 major (node24 runtime; requires act_runner >= 0.2.13).

.gitea/workflows/ci.yml

@@ -10,9 +10,9 @@ jobs:
   verify:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
           node-version: 24
           cache: npm
@@ -35,9 +35,9 @@ jobs:
     runs-on: ubuntu-latest
     environment: release
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
           node-version: 24
           cache: npm