chore: upgrade actions to Node 24 runtime (SHA-pinned)

[John C. Bland II (johncblandii)]

what

• Bump GitHub Actions references in the workflows to versions running on the Node 24 runtime,
  SHA-pinned with precise version comments:
  • actions/checkout@v4 → @3d3c42e5... # v7.0.1
  • actions/setup-node@v4 → @82076278... # v7.0.0
  • actions/setup-python@v5 → @5fda3b95... # v7.0.0

why

• GitHub is deprecating the Node 20 runtime; affected workflows emit a deprecation warning and
  are already being force-migrated to Node 24
• SHA pinning with a verified tag comment makes the upgrade deliberate and supply-chain-safe,
  matching the org's direction in chore: upgrade actions to Node 24 runtime and enforce SHA pinning .github#261
• Every pinned SHA was verified against its upstream tag

references

• https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

[Copilot]

Pull request overview

Updates the deploy GitHub Actions workflow to use SHA-pinned versions of key actions/* steps intended to run on the newer Node 24 runtime, aligning with supply-chain hardening via commit pinning.

Changes:

• Replace actions/checkout, actions/setup-node, and actions/setup-python version tags with SHA-pinned references plus version comments.
• Standardize action references to explicit commits to avoid implicit runner/runtime changes.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Erik Osterman (Cloud Posse) (osterman)]

Approving. Three pins verified against upstream tags, no action.yml / Dockerfile / permissions / release-config changes, so zero downstream impact.

Worth knowing this change is currently inert: the job being pinned is if: false # disable for now (pre-existing), which is also why the checks skip rather than exercise it. That same disabled job holds run: make push with env: GH_TOKEN: ${{ secrets.PAT }} — nothing here weakens it, but it deserves a fresh look if it's ever re-enabled.

Also: action.yml already declares using: 'node24', so this repo never needed the runtime upgrade the title describes.