Move CI actions to Node 24 runtimes

[dhruvbatra]

GitHub forces actions onto Node 24 starting 2026-06-16 (and removes Node 20 from runners 2026-09-16). The v0.7.9 publish run's annotations flagged all three actions we use as Node 20.

• actions/checkout v4 → v5 (using: node24, verified)
• actions/setup-python v5 → v6 (using: node24, verified)
• softprops/action-gh-release SHA re-pinned v2.6.2 → v3.0.0 (b430933...) — its release notes confirm v3.0.0 is a runtime-only change (Node 20 → 24) with no input changes; our usage (files:) is unaffected. Still pinned by commit SHA since it runs with contents: write.

The CI jobs on this PR exercise checkout/setup-python at the new versions; the gh-release pin gets exercised on the next release.

🤖 Generated with Claude Code

---

Note

Low Risk
Workflow-only dependency bumps with no application code changes; publish still gates on tests and keeps the gh-release action SHA-pinned.

Overview
Updates CI and PyPI publish workflows so they run on GitHub’s upcoming Node 24 action runtimes instead of Node 20.

In ci.yml, every job that used actions/checkout@v4 and actions/setup-python@v5 now uses @v5 and @v6 respectively (lint, test matrix, package, and install-sh). The install-sh job only bumps checkout; it never used setup-python.

In publish_to_pypi.yml, checkout and setup-python get the same version bumps. The release asset upload step re-pins softprops/action-gh-release from the v2.6.2 commit to v3.0.0 (b430933…), still by full SHA because that action has contents: write. Workflow inputs (e.g. files:) are unchanged.

^{Reviewed by Cursor Bugbot for commit e47b00d. Bugbot is set up for automated code reviews on this repo. Configure here.}