Update .cicd submodule: fix download-artifact-verified to use gh api

Updates .cicd submodule to commit 7d9bbfc which fixes the critical issue where
download-artifact-verified was using 'gh artifact download' command that doesn't
exist in GitHub Actions runners.

The fixed action now uses 'gh api' with GitHub REST API endpoints:
- Lists artifacts via /repos/{owner}/{repo}/actions/runs/{run_id}/artifacts
- Filters by name using jq
- Downloads zip via /repos/{owner}/{repo}/actions/artifacts/{artifact_id}/zip
- Extracts to destination with full retry logic

This should resolve the source distribution download failures in release workflows.

AI-Disclosure: Assisted by Claude Code (Anthropic, Claude 3.7 Sonnet)

Author: oberstet