chore: bump pinned github actions to latest majors

[aeaa1998]

Stack 3/3 — based on #203, merge that first. Review only the top commit; the diff will shrink as the stack lands.

• 1/3 chore: bump action runtime to Node 24 #202 Node 24 runtime → main
• 2/3 fix: resolve all npm audit advisories #203 npm audit fixes → chore: bump action runtime to Node 24 #202
• 3/3 this PR — GitHub Actions bumps → fix: resolve all npm audit advisories #203

What

All three pinned actions were majors behind:

Action	From	To
actions/checkout	v4.3.0	v7.0.1
actions/setup-node	v4.3.0	v7.0.0
actions/upload-artifact	v4.6.2	v7.0.1

Each pinned SHA now carries a # vX.Y.Z comment. Nothing in the repo recorded what version a pin was, which is how they drifted this far unnoticed — and dependabot maintains those comments automatically.

Why now

The runner is already force-upgrading the old pins. From a run before this change:

Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@08eba0b2…

That warning is gone on this branch.

Breaking changes reviewed

Two in the majors we cross, neither of which applies here:

• checkout v7 blocks fork-PR checkout under pull_request_target / workflow_run — our workflows use plain pull_request.
• upload-artifact v7 restricts uploads to a single file only when archive: false is set, which is opt-in. We upload path: dist/ normally.

Also relevant: setup-node v5's notes confirm the runner requirement documented in #202 — Node 24 needs runner v2.327.1 or later.

Validation

Dispatched CI on this branch, all green:

• build-test
• Check dist/

This branch carries all three layers, so those runs are also the end-to-end check of the full stack.

---

🤖 Generated with Claude Code

https://claude.ai/code/session_01UTdciRVE8crbaoxq4JyXt4

---

Generated by Claude Code