ci: bump Node-20 GitHub Actions to Node-24-compatible versions before 2026-06-16

[dfattal]

Problem

GitHub is forcing Actions onto Node.js 24 by default on 2026-06-16, and removing the Node 20 runtime on 2026-09-16 (changelog). Several actions pinned across our release workflows still ship a Node-20 entrypoint and emit the deprecation warning on every run (observed during the v1.7.0 / shell v1.4.0 / bundle v0.7.0 ship).

Affected actions (runtime repo inventory)

Action	Pinned	Bump to
actions/checkout	@v4 (×22)	@v5
actions/upload-artifact	@v4 (×16)	@v5
actions/download-artifact	@v4 (×9)	@v5
actions/create-github-app-token	@v1 (×3)	@v2
actions/setup-java	@v4 (×1)	@v5
actions/cache	@v4 (×1)	@v5
softprops/action-gh-release	@v2 (×3)	latest @v2 patch (already Node-24) or pin SHA

Also in sibling repos (same fix needed)

• displayxr-shell-pvt — publish-shell-releases.yml: create-github-app-token@v1, download-artifact@v4, peter-evans/repository-dispatch@v3.
• displayxr-installer — publish-bundle.yml / build-bundle.yml: checkout@v4, download-artifact@v4, softprops/action-gh-release@v2.
• Likely also displayxr-leia-plugin, displayxr-mcp, displayxr-demo-gaussiansplat, displayxr-extensions (publish-extensions.yml uses create-github-app-token@v1).

Scope

Mechanical version bumps only — no logic change. Verify each bumped action's API is unchanged (e.g. upload/download-artifact@v4→v5 kept the same inputs; create-github-app-token@v1→v2 is compatible). One PR per repo. Not urgent for correctness today (warnings only), but must land before 2026-06-16 to avoid forced-migration surprises, and before 2026-09-16 when Node 20 is removed entirely.

Acceptance

• No Node.js 20 actions are deprecated warning in any release/build workflow run across the org.
• A green release dry-run (or the next real release) on the bumped workflows.