ci: bump actions to v5 (node 24 runtime)

[Lef-F]

What

Bump the two third-party actions to their Node 24-compatible major versions:

• `actions/checkout@v4` → `actions/checkout@v5`
• `aws-actions/configure-aws-credentials@v4` → `aws-actions/configure-aws-credentials@v5` (used in both deploy and cleanup jobs)

Why

GitHub runners emit a deprecation warning on every run because both actions currently ship Node.js 20 binaries. Node 20 will be forced off on June 2, 2026 and removed from runners on September 16, 2026. Both actions have v5 releases that use Node 24 and clear the warnings.

Side-benefit

Opening this PR is also the first real exercise of the new preview-deploy flow. When this PR opens it should spin up `ci-bump-actions-v5.lef.fyi`. When it closes, the cleanup job should tear the bucket and CNAME back down. That's the whole contract the previous PR established, tested on itself.

Test plan

• On `opened`: `deploy` job creates `ci-bump-actions-v5.lef.fyi`, cache purge is scoped to just that host.
• Preview serves the same content as main (this PR doesn't touch src/).
• On `closed` (after merge): `cleanup` job deletes the preview bucket + CNAME.
• Post-merge push-to-main run: no more Node 20 deprecation warnings in the log.