Update Ruby to 4.0.6 and update gems

[dadachi]

Summary

• Bump Ruby 4.0.3 → 4.0.6 (.ruby-version; CI and Gemfile read from it)
• bundle update for all gems, notably:
  • faraday 2.14.2 → 2.14.3 — fixes CVE-2026-54297 / GHSA-98m9-hrrm-r99r (High), which was failing the scan_ruby (bundler-audit) check on every open Dependabot PR
  • aasm 5.5.2 → 6.0.0 (major; full test suite passes)
  • Supersedes the 8 gem bumps in Dependabot PR Bump the minor-and-patch group across 1 directory with 8 updates #89

Dependabot

• Bump the minor-and-patch group across 1 directory with 8 updates #89 becomes redundant once this merges (Dependabot should auto-close it)
• Bump actions/cache from 5 to 6 #88 and Bump actions/checkout from 6 to 7 #86 (GitHub Actions bumps) only failed scan_ruby because of the faraday advisory on main; rebase them after this merges and they should go green

Verification

• bin/rubocop — 253 files, no offenses
• bin/brakeman — no warnings
• bin/bundler-audit — no vulnerabilities
• bin/rails test — 438 runs, 916 assertions, 0 failures

🤖 Generated with Claude Code

https://claude.ai/code/session_01J6rAaUbYuFz9YZrZTN6Pz2