Opening a pull request with labels, as `gh pr create --label` does,
fires `labeled` a moment after `opened`. Both started the news check,
and the concurrency group cancelled the first run, which the PR then
listed as a failed `📝 News fragment` check while the other run passed. 👷

This moves the news check to [github-workflows
6.3.0](tox-dev/github-workflows#40), whose
`validate-news` passes at once for a label set within a minute of
opening since the run for opening already reads the current labels, and
stops cancelling runs in progress. The check keeps its name, so the
ruleset needs no change.

[release-creator 4.4.0](https://pypi.org/project/release-creator/4.4.0/)
accepts descriptive changelog fragment names without a `+` prefix.
Update this project's news check and release tools to that version.

The package-specific cutoff admits the new release during the seven-day
cooldown. The lock changes only `release-creator` and dependencies it no
longer requires.

Publish [OpenSSF Scorecard](https://scorecard.dev/) results for this
repository and show its score in the README. The README also links its
new Best Practices registration. Analysis runs through
[tox-dev/github-workflows#42](tox-dev/github-workflows#42);
this repository controls the triggers and token permissions.

Co-authored-by: Bernát Gábor <gaborjbernat@gmail.com>
Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

filelock's checks and release maintenance now come from the
[tox-dev/github-workflows](https://github.com/tox-dev/github-workflows)
repository shared by the tox-dev projects, so a fix to the release
notes, the GitHub Release or the CodeQL setup lands once for all of
them. 🔧

The tox environment checks (`dev`, `type`, `docs`, `pkg_meta`) run from
the shared check workflow, on Ubuntu and Windows. The GitHub Release is
created by the shared release workflow after the PyPI artifacts are
verified. The required checks `🚦 Required checks pass` and `🏗️ Build
distributions` keep their names, so branch protection does not change.

The dependency hygiene part pins the shared workflows to
[6.5.0](https://github.com/tox-dev/github-workflows/tree/6.5.0) and
moves setup-uv to v10.3.3. 📌

### Architecture

The shared workflows own the generic parts: the tox environment checks,
CodeQL, the release notes and the GitHub Release with its PyPI check.
This repository keeps what is specific to filelock: the test matrix with
its PyPy special case, the NFS, SMB, Termux and capability checks that
exercise real file systems, the weekly GraalPy run, the benchmark
matrix, and the PyPI upload with trusted publishing. The gate reads
every job result through the shared required-checks action, and GraalPy
may still be skipped.

### Behavior changes

The PyPI upload no longer waits for the release notes to render, which
run in parallel. A broken changelog section still blocks the GitHub
Release.

The CodeQL checks are now named `🛡️ Analyze / 🛡️ Analyze actions` and
`🛡️ Analyze / 🛡️ Analyze python`. No ruleset requires the old names.

The tox environment checks no longer set `UV_PYTHON_PREFERENCE`, because
the shared check workflow does not expose that setting.

The `release-creator` cutoff exception in `pyproject.toml` now records
its expiry, 2026-11-09, which the file's existing comment already
states.