ci: update GitHub action runtime pins

[longlho]

Summary

• update pinned actions/checkout, actions/setup-node, actions/upload-artifact, and actions/download-artifact SHAs to Node 24-backed releases
• apply the same pins across release and test workflows so the Node 20 deprecation warnings do not move to another workflow
• keep full-length SHA pins to match the repo policy

Validation

• git diff --check
• parsed all .github/workflows/*.yml with Ruby YAML
• verified the new action SHAs resolve to action.yml files using node24