ci: bump CI actions off deprecated Node 20 and pin by SHA

[drawmeanelephant]

Agent Completion Report

• Status: complete
• Branch and Worktree:
  • Branch: ci/ci-actions-node24
  • Worktree: ci/ci-actions-node24 (main checkout)
• Commit and PR:
  • Commit: 00bc4e0a
  • Target PR / Branch: ci: bump CI actions off deprecated Node 20 and pin by SHA #963 / main
• Linked Issues (auto-close convention):
  • None. No issue tracker card; CI maintenance follow-up to ci(pages): bump Pages actions off deprecated Node 20 #962.
• Changed Files:
  • .github/workflows/ci.yml
  • docs/changelog.d/963-ci-actions-node24.md
• Preserved Unrelated Files:
  • No other tracked files modified; opened from an up-to-date main with a clean tree.
• Implementation Summary:
  • Bumped actions/checkout v4 → v7.0.1, actions/setup-node v4 → v7.0.0, actions/upload-artifact v4 → v7.0.1, and dorny/paths-filter v3 → v4.0.3; all Node 24 releases.
  • Pinned every action in ci.yml by commit SHA with a version comment, including the previously-SHA-pinned checkout copy and mlugg/setup-zig (latest upstream v2.2.1, still Node 20).
  • Added the required changelog fragment.
• Known Gaps:
  • mlugg/setup-zig v2.2.1 remains Node 20 (upstream; no fix). Runner forces Node 24 and it succeeds; a warning remains.
• Exact Commands Run:
  1. zig build test
  2. python3 -c "import yaml; yaml.safe_load(open('.github/workflows/ci.yml'))"
  3. gh pr checks 963 (pending at report time)
• Exact Gate Results:
  • zig build test: pass
  • ci.yml YAML parse: pass
  • Every uses: SHA-pinned: verified
  • PR CI (all lanes): running
• Determinism Result:
  • N/A — workflow pin change only.
• Generated Artifacts:
  • None.
• Blockers and Next Card:
  • Blockers: None
  • Next Card: Confirm all ci lanes pass on this PR, then merge the same way as ci(pages): bump Pages actions off deprecated Node 20 #962.