chore(ci): bump socket-registry actions to 13684cd8 (gh telemetry opt-out)

[John-David Dalton (jdalton)]

Summary

• Bumps all SocketDev/socket-registry/.github/actions/* pins from ebf1b48f to 13684cd8 (the current propagation SHA).
• The new SHA includes an opt-out of GitHub's on-by-default gh CLI telemetry via DO_NOT_TRACK=1 and GH_TELEMETRY=0, written to \$GITHUB_ENV in the shared setup composite action.
• Cascade layers 1 → 4 in socket-registry are already merged; this PR is the consumer propagation.

Test plan

• CI (uses the bumped pins) runs green.
• Release-time gh calls no longer report telemetry — confirmable by the absence of the consent banner on fresh runners.

---

Note

Medium Risk
Updates the pinned SocketDev/socket-registry composite actions used across CI, publish, and weekly-update workflows, which could change runner setup behavior and impact builds/releases if the new action version has regressions.

Overview
Updates GitHub workflows to use a newer pinned SHA for SocketDev/socket-registry/.github/actions/* (notably setup-and-install, plus git-signing setup/cleanup) across CI, publish (provenance.yml), and the weekly dependency update workflow.

No application code changes; this only alters the underlying shared action implementation used during installs/signing, including the upstream change to disable gh telemetry via environment configuration.

^{Reviewed by Cursor Bugbot for commit 16185f0. Configure here.}

[John-David Dalton (jdalton)]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 16185f0. Configure here.}