Key the linters' venv cache on the exact Python version

The cached ./venv links to the interpreter it was built with. Since #917
resolves '3.14' to the latest patch, a new patch release (3.14.9 to
3.14.10) leaves the cached venv pointing at a missing interpreter, and
the cache hit skips the install, so 'python -m ruff' runs without Ruff.

Include setup-python's resolved python-version in the cache key, so each
patch release builds a fresh venv, and update checkout, setup-python, and
cache to their current major versions (as proposed in #717).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: lpozo

.github/workflows/linters.yml

@@ -21,21 +21,24 @@ jobs:
           - {name: Linux314, python: '3.14', os: ubuntu-latest}
     steps:
     - name: Check out repository
-      uses: actions/checkout@v2
+      uses: actions/checkout@v4
 
     - name: Set up Python
-      uses: actions/setup-python@v2
+      id: setup-python
+      uses: actions/setup-python@v5
       with:
         python-version: ${{ matrix.python }}
 
+    # The cached venv links to the exact interpreter it was built with,
+    # so the key includes the resolved patch version (for example, 3.14.10).
     - name: Restore cache
       id: cache
-      uses: actions/cache@v3
+      uses: actions/cache@v4
       with:
         path: ./venv
-        key: ${{ matrix.name }}-v2-pip-${{ hashFiles('requirements.txt') }}
+        key: ${{ matrix.name }}-${{ steps.setup-python.outputs.python-version }}-pip-${{ hashFiles('requirements.txt') }}
         restore-keys: |
-          ${{ matrix.name }}-v2-pip-
+          ${{ matrix.name }}-${{ steps.setup-python.outputs.python-version }}-pip-
 
     - name: Install dependencies
       if: steps.cache.outputs.cache-hit != 'true'