ci: fix action runtime and audit drift

[code-yeongyu]

Summary

• Update first-party GitHub actions to Node 24-based pinned SHAs: checkout v6.0.3, setup-node v6.4.0, upload-artifact v7.0.1.
• Add an always-run merge/release outcome summary to the upstream merge workflow so runs show whether upstream work existed, PR merge happened, release audit passed, and release/dry-run/no-release follow-up ran.
• Resolve npm audit findings by pinning patched transitive versions and regenerating the coding-agent shrinkwrap.
• Keep the PR530 benchmark gate focused on runtime/benchmark/TypeScript changes, so metadata-only dependency/audit PRs do not run noisy all-suite benchmarks.

QA evidence

• actionlint .github/workflows/ci.yml .github/workflows/npm-audit.yml .github/workflows/build-binaries.yml .github/workflows/publish-npm.yml .github/workflows/task-11-benchmarks.yml .github/workflows/upstream-agent-merge.yml passed.
• actionlint .github/workflows/task-11-benchmarks.yml passed after the benchmark scope correction.
• git diff --check passed.
• npm run check passed. Biome still reports pre-existing useLiteralKeys info diagnostics, but exits 0 and made no fixes.
• npm audit --audit-level=moderate passed with 0 vulnerabilities.
• npm audit --omit=dev --audit-level=moderate passed with 0 vulnerabilities.
• npm audit signatures --omit=dev passed: 191 packages verified, 30 attestations.
• node scripts/generate-coding-agent-shrinkwrap.mjs --check passed.
• senpi QA evidence written locally under local-ignore/qa-evidence/20260618-merge-release-audit/:
  • common.mjs --self-check: 9/9 passed, real auth unchanged.
  • cli-smoke.mjs --self-test: 5/5 passed, real auth unchanged.
  • mock-loop.mjs --self-test --evidence merge-release-audit-mock-loop: 5/5 passed across openai-completions, anthropic-messages, and openai-responses; only localhost fake model calls; real auth unchanged.
• Commit hooks ran npm run check; the dependency commit hook also ran verify:pms for npm/bun/pnpm install + build and browser smoke; all passed.

Notes

• The first two PR530 benchmark runs failed due all-suite benchmark noise after root dependency metadata changes; the workflow now skips benchmark execution for metadata-only changes that do not touch runtime, benchmark, package source manifests, or TypeScript config.
• scripts/generate-coding-agent-shrinkwrap.mjs is a pre-existing 316 pure LOC file. This change only updates the existing protobufjs allowlist entry and does not add logic.