chore(deploy): require dash 4.0.7 across the docs deploy path

[mhenrixon]

Summary

dash v4.0.7 is out with two deploy-path fixes every docs site wants:

• doctor passes a stale proxy that the next deploy reboots automatically (fix(doctor): pass a stale proxy the next deploy reboots automatically dash#149)
• the registry login fails fast when a credential resolves blank (fix(registry): fail fast when a registry credential resolves blank dash#148)

This raises the dash floor to 4.0.7 everywhere docs-kit states it:

Where	Before	After
.github/workflows/deploy.yml (reusable — every site inherits via @main)	gem install dash -v "~> 4.0"	~> 4.0.7
docs/config/deploy.yml (this site)	minimum_version: 4.0.0	4.0.7
lib/docs_kit/templates/new_site.rb (docs-kit new)	minimum_version: 4.0.0	4.0.7
docs deploy page + README prose	4.0.0	4.0.7

Follow-up PRs bump minimum_version in the eight consuming docs sites, then every site redeploys.

Test plan

• bundle exec rake (rspec + rubocop) green — no spec layer asserts these pins (workflow YAML / heredoc template / prose), so the full suite is the regression gate.
• Real proof is the redeploys of the consuming sites after merge.

Deviations & judgment calls

• ~> 4.0.7 pins the 4.0.x patch line (was ~> 4.0, floating all of 4.x). Future dash minors reach the deploy path only via an explicit bump here — deliberate-upgrade over auto-float.
• No RED test written: the pins live in workflow YAML, a heredoc template, and docs prose — no spec layer covers them.
• daisyui and dash docs sites have no minimum_version key at all (older scaffolds); their follow-ups add it rather than bump it.
• zoolutions/dash pins this reusable workflow at a SHA (zizmor) — its caller gets a SHA bump to the post-merge commit in its follow-up.

https://claude.ai/code/session_01KsqvKPn1c1hWu6NSEQHy1W

---

Summary by cubic

Raises the dash version floor to 4.0.7 across the docs deploy path so every site gets dash 4.0.7's stale-proxy recovery and registry credential fail-fast fixes.

Dependencies

• The reusable workflow now installs ~> 4.0.7, and minimum_version is 4.0.7 in the site config, new-site template, docs page, and README.
• ~> 4.0.7 pins the 4.0.x patch line, so future dash minors reach the deploy path only via an explicit bump.

Migration

• Follow-up PRs bump minimum_version in the eight consuming docs sites, then each redeploys.
• The two older site scaffolds without a minimum_version key get it added rather than bumped.
• Callers of the reusable workflow pinned at a SHA get a SHA bump to the post-merge commit.

^{Written for commit b4c9726. Summary will update on new commits.}