chore: bump Node-20 GitHub Actions to Node-24 compatible SHAs #109

Problem

The release.yml workflow run for v0.2.17 (run 26447314533) emitted a Node.js 20 deprecation annotation on three pinned actions:

The annotation reads:

Node.js 20 actions are deprecated. … Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026.

These actions are also used across ci.yml, security.yml, pr-title.yml, branch-protection.yml, eval-nightly.yml, changelog-prestage.yml, changelog-rollup.yml, release-drafter.yml, pin-freshness-audit.yml, artifact-cleanup.yml, and codeql.yml. The same SHAs likely appear in .github/actions/setup-uv-python/action.yml and other composite actions — scope confirmation needed.

Proposed solution

1. Identify all SHAs pinned to Node-20-only releases. A grep over .github/workflows/**/*.yml and .github/actions/**/*.yml for the three SHAs above is the floor; the existing weekly pin-freshness-audit workflow may already be flagging these as documented-tag-re-tagged.
2. Bump each to a Node-24-compatible SHA of the corresponding action — verify upstream releases (actions/checkout ≥ v5, actions/setup-python ≥ v6, docker/login-action post-Node24 release) before pinning. Keep the trailing # vN.M.P tag comment per docs/DEVELOPMENT.md#action-pinning-policy.
3. Re-run a release-style workflow locally via workflow_dispatch (e.g. eval-nightly.yml) to verify no warnings remain.

Acceptance criteria

• All occurrences of the three flagged SHAs replaced with Node-24-compatible equivalents across .github/workflows/ and .github/actions/
• No Node.js 20 deprecation annotations on the next workflow run touching these actions
• Trailing tag comments (# vN.M.P) updated to match the new SHAs
• Verified by re-running pin-freshness-audit after the bump — output should be clean

Priority rationale

Hard deadline 2026-06-02 (≈one week from issue filing). On that date, runners force Node-24 unconditionally; if any of the pinned action versions don't support Node-24, the workflows break. The follow-up removal on 2026-09-16 is a second forcing function. Cheap, well-scoped change — the existing pin-freshness audit machinery is exactly what makes this easy to verify.