ci: upgrade actions that still target deprecated Node.js 20

[lmeyerov]

Release-readiness finding

Current CI is green, but GitHub emits this warning on #2013 jobs:

Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24.

Observed affected actions include:

• actions/checkout@v4
• actions/download-artifact@v4
• actions/setup-python@v5

GitHub currently forces these actions onto Node.js 24, so this does not block 0.59.0. It is a forward CI reliability risk once compatibility forcing is removed or action behavior diverges.

Reference: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

Acceptance criteria

• Inventory every workflow action that still targets Node.js 20.
• Upgrade to Node.js 24-native maintained action releases, respecting this repository's action pin/cooldown security policy.
• Run actionlint and zizmor.
• Run the full CI/workflow-security matrix and confirm the Node.js 20 warnings are gone.