[codex] align TestPyPI workflow action versions

[stacknil]

Summary

Align the sbom-diff-and-risk TestPyPI workflow action pins with the current CI baseline.

This PR updates only .github/workflows/sbom-diff-and-risk-testpypi.yml:

• actions/checkout@v5 -> actions/checkout@v6
• actions/upload-artifact@v4 -> actions/upload-artifact@v7
• actions/download-artifact@v4 -> actions/download-artifact@v8

Safety behavior preserved

The TestPyPI workflow remains manually gated. publish_to_testpypi still defaults to false, and the publish-testpypi job still requires workflow_dispatch with explicit publish_to_testpypi=true.

This PR does not add a production PyPI workflow, does not change package metadata, does not touch CLI behavior, and does not alter release assets or publishing policy.

Validation

• git diff --check
• Confirmed only .github/workflows/sbom-diff-and-risk-testpypi.yml changed
• Confirmed .github/workflows/ still contains no production PyPI workflow
• Confirmed TestPyPI publish target remains https://test.pypi.org/legacy/

After merge, run the no-publish workflow dispatch on main:

gh workflow run sbom-diff-and-risk-testpypi.yml --ref main -f publish_to_testpypi=false

Expected result: build/check succeeds and the TestPyPI publish job is skipped.