ci: run workflows on Node 24 and pin actions to commit SHAs

[benradstone]

Describe the Change

This PR moves the workflows from Node 22 to Node 24 so that Dependabot's npm PRs can pass CI, and fixes the zizmor findings in release.yaml and test.yaml so that bulwark doesn't block this PR or future Actions bumps.

Why Node 24. Dependabot regenerates package-lock.json with npm 11. Node 22 ships npm 10.9, which rejects those lockfiles (npm ci: Missing: conventional-commits-filter@6.0.1 ... from lock file). That's why "Docker Dev image" and "Semantic Release Dry Run" fail on #130–#134, and it's the same drift #127 fixed by hand last month. hello-universe already runs on Node 24 and doesn't have this problem.

Changes

• NODE_VERSION goes from "22" to "24" in both workflows.
• Every action is pinned to a commit SHA with a # vX.Y.Z comment, which zizmor's unpinned-uses rule requires. Floating tags (@v7, @v4) are pinned to the commit they resolve to today, so the code that runs doesn't change. Dependabot keeps SHA pins and their comments up to date.
• docker/setup-buildx-action is pinned at v4.4.1 and docker/build-push-action at v7.4.0. These are the versions in chore: bump docker/setup-buildx-action from 4.3.0 to 4.4.1 #128 and chore: bump docker/build-push-action from 7.3.0 to 7.4.0 #129, which this PR supersedes; Dependabot should close them once it merges.
• The cosign step reads $GITHUB_REPOSITORY, $GITHUB_WORKFLOW, and $GITHUB_SHA instead of expanding ${{ github.* }} into the script (fixes template-injection).
• package-manager-cache: false is set on setup-node in the two jobs that push images (fixes cache-poisoning). This changes nothing at runtime because package.json has no packageManager field.
• packages: write moves from the workflow level to the docker job, the only job that pushes to GHCR (fixes excessive-permissions).

Review Changes

Verified locally:

• With bulwark's org config, zizmor reports 0 High or Critical findings, down from 21. The remaining findings are Medium excessive-permissions and Low artipacked, which already existed and don't trigger the bulwark review.
• actionlint reports no new findings.
• npm ci passes on Node 24 against both main's lockfile and the lockfiles in chore: bump @commitlint/config-conventional from 21.2.0 to 21.2.3 #130–chore: bump semantic-release from 25.0.8 to 25.0.9 #134. All of those fail on npm 10.9.
• I checked every pinned SHA against GET /repos/{owner}/{repo}/commits/{tag}.

After this merges, comment @dependabot rebase on #130–#134.

🎫 Jira Ticket: none

🤖 Generated with Claude Code