chore(deps): update metio ci

Author: renovate[bot]

.github/workflows/release.yml

@@ -34,13 +34,13 @@ jobs:
           fetch-depth: 0
       - id: gate
         name: Check whether a release is needed
-        uses: metio/ci/needs-release@0b7421952e03e7be2aab6ea5ea10721609d12aac # 2026.8.2070928
+        uses: metio/ci/needs-release@6ccbfec6667dbf259d07ae33159592fb80f4aba2 # 2026.8.4134806
         with:
           paths: go.mod main.go internal api config Dockerfile
       - id: version
         name: Compute the next version
         if: steps.gate.outputs.needed == 'true'
-        uses: metio/ci/calver@0b7421952e03e7be2aab6ea5ea10721609d12aac # 2026.8.2070928
+        uses: metio/ci/calver@6ccbfec6667dbf259d07ae33159592fb80f4aba2 # 2026.8.4134806
   build:
     name: Build ${{ matrix.goos }}/${{ matrix.goarch }}
     needs: prepare
@@ -128,7 +128,7 @@ jobs:
       - name: Clone Git Repository
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
       - name: Build, push and sign the image
-        uses: metio/ci/container-release@0b7421952e03e7be2aab6ea5ea10721609d12aac # 2026.8.2070928
+        uses: metio/ci/container-release@6ccbfec6667dbf259d07ae33159592fb80f4aba2 # 2026.8.4134806
         with:
           image: ghcr.io/${{ github.repository }}
           version: ${{ needs.prepare.outputs.version }}
@@ -166,12 +166,12 @@ jobs:
           shopt -s nullglob
           sha256sum ./*.tar.gz ./*.zip > "$SUMS"
       - name: Sign Checksums (cosign keyless)
-        uses: metio/ci/cosign-sign-blob@0b7421952e03e7be2aab6ea5ea10721609d12aac # 2026.8.2070928
+        uses: metio/ci/cosign-sign-blob@6ccbfec6667dbf259d07ae33159592fb80f4aba2 # 2026.8.4134806
         with:
           file: dist/${{ github.event.repository.name }}_${{ needs.prepare.outputs.version }}_SHA256SUMS
       - id: notes
         name: Generate Release Notes
-        uses: metio/ci/release-notes@0b7421952e03e7be2aab6ea5ea10721609d12aac # 2026.8.2070928
+        uses: metio/ci/release-notes@6ccbfec6667dbf259d07ae33159592fb80f4aba2 # 2026.8.4134806
         with:
           version: ${{ needs.prepare.outputs.version }}
           previous: ${{ needs.prepare.outputs.previous }}

.github/workflows/verify.yml

@@ -14,7 +14,7 @@ jobs:
     # detect job auto-enables envtest and arch-go from this repo's files. Named
     # "Golang" so its checks read "Golang / test", "Golang / lint", …
     name: Golang
-    uses: metio/ci/.github/workflows/golang.yml@0b7421952e03e7be2aab6ea5ea10721609d12aac # 2026.8.2070928
+    uses: metio/ci/.github/workflows/golang.yml@6ccbfec6667dbf259d07ae33159592fb80f4aba2 # 2026.8.4134806
   reuse:
     runs-on: ubuntu-latest
     timeout-minutes: 15
@@ -151,7 +151,7 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           fetch-depth: 0
-      - uses: metio/ci/dco@0b7421952e03e7be2aab6ea5ea10721609d12aac # main
+      - uses: metio/ci/dco@6ccbfec6667dbf259d07ae33159592fb80f4aba2 # main
   policy:
     # metio org workflow conventions (conftest/Rego from metio/ci): SHA-pinned
     # uses refs, top-level permissions, timeout-minutes on every job, no
@@ -160,7 +160,7 @@ jobs:
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-      - uses: metio/ci/policy-check@0b7421952e03e7be2aab6ea5ea10721609d12aac # 2026.8.2070928
+      - uses: metio/ci/policy-check@6ccbfec6667dbf259d07ae33159592fb80f4aba2 # 2026.8.4134806
   verify:
     # Single required check covering every job above: mark only this one
     # required in branch protection and new jobs are covered automatically.