chore(ci): clear the last three stale pins — actionlint, diff-cover, jq (#378)

[VijitSingh97]

Clears the last three stale pins on the currency report (#378).

tool	from	to	verified by
actionlint	1.7.7	1.7.12	the Lint job — it runs the new actionlint over these workflows
diff-cover	10.3.0	10.5.1	the Coverage job — it installs and runs it
jq	1.7.1	1.8.2	the Coverage job — the suite runs through it inside the kcov container

One PR rather than three because each lands in a different CI job, so green here is unambiguous.
A red would not be, and would want splitting — say so rather than debugging a batch.

What was run

Both checksums were recomputed from the release artifacts, not copied from a release page, and
then re-verified against a fresh download of the exact file CI will fetch:

actionlint_1.7.12_linux_amd64.tar.gz: OK
jq-linux-amd64: OK
  ci.yml carries the actionlint sha: OK
  coverage.sh carries the jq sha: OK

actionlint 1.7.12 run locally over every workflow — the risk with bumping a linter is that the
newer one flags existing files:

actionlint 1.7.12: CLEAN on all workflows

jq 1.8.2 answers the filter shape tests/coverage.sh uses (jq-1.8.2, .percent_covered →
91.5).

What was NOT run

The coverage suite itself — it needs Docker and a kcov container, which is the Coverage job's
whole job. That check is the gate for both diff-cover and jq, and it is the reason those two are in
a PR at all rather than applied blind.

After this

#378 should show every pin current on its next run. The remaining unverified path in this area is
xmrig-bump.yml: it is not blocked the way tool-bump.yml was (XMRig lives in rigforge.sh,
which GITHUB_TOKEN may push), but it has never actually pushed either, because that pin has been
current every week. Worth proving before the day it matters.