fix(#445): upgrade Windows checkout v4→v5.0.1 + remove FORCE_JAVASCRIPT_ACTIONS_TO_NODE24 (node20 EOL) (#446)

Problem: Node 20 deprecation warnings fired on every CI run. Despite
FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true in test.yml (added in PR #350),
the warning is not silenced — the env var only changes which warning fires
(both paths call context.Warning()). The only silent path is for the action
itself to declare `using: node24`.
Ref: https://github.com/actions/runner/blob/main/src/Runner.Common/Util/NodeUtil.cs
Ref: https://github.com/actions/runner/blob/main/src/Runner.Worker/JobExtension.cs

Three locations used @v4 actions (node20 runtime):

1. test.yml — Windows lanes (test + test-full jobs) pinned to
   actions/checkout@11bd71901b (v4.2.2).
   Original pin rationale (PR #162 / issue #161): v6 uses includeIf.gitdir:
   for auth injection, which is unreliable on Windows git 2.54.
   v5 never used includeIf, so it is safe for Windows.
   Upstream confirmation: https://github.com/actions/checkout/pull/2425
   v5 action.yml declares `using: node24`: https://raw.githubusercontent.com/actions/checkout/v5/action.yml

2. changeset-required.yml — floating actions/checkout@v4 + actions/setup-node@v4

3. docs-required.yml — same floating @v4 pattern

Changes:
- test.yml: both Windows checkout steps v4.2.2 → v5.0.1
  (SHA 11bd71901bbe5b1630ceea73d27597364c9af683 → 93cb6efe18208431cddfb8368fd83d5badbf9bfd)
- test.yml: update comment on Windows checkout to reflect v5 rationale
- test.yml: no FORCE_JAVASCRIPT_ACTIONS_TO_NODE24 was present on origin/next
  (already absent; the env block was on the main-branch version only)
- changeset-required.yml: actions/checkout@v4 → @93cb6efe18208431cddfb8368fd83d5badbf9bfd (v5.0.1)
- changeset-required.yml: actions/setup-node@v4 → @a0853c24544627f65ddf259abe73b1d18a591444 (v5.0.0)
- docs-required.yml: same as changeset-required.yml

SHAs resolved from upstream tags:
- checkout v5.0.1: gh api repos/actions/checkout/git/ref/tags/v5.0.1 → 93cb6efe18208431cddfb8368fd83d5badbf9bfd
- setup-node v5.0.0: gh api repos/actions/setup-node/git/ref/tags/v5.0.0 → a0853c24544627f65ddf259abe73b1d18a591444

Closes #445

Co-authored-by: CI Rebase Check <ci@gsd-redux>

.github/workflows/changeset-required.yml

@@ -16,14 +16,14 @@ jobs:
   changeset-lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd  # v5.0.1
         with:
           fetch-depth: 50
       - name: Fetch base ref for diff
         run: git fetch --depth=50 origin "${BASE_REF}:refs/remotes/origin/${BASE_REF}"
         env:
           BASE_REF: ${{ github.event.pull_request.base.ref }}
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444  # v5.0.0
         with:
           node-version: '24'
       - name: Run changeset lint

.github/workflows/docs-required.yml

@@ -16,14 +16,14 @@ jobs:
   docs-lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd  # v5.0.1
         with:
           fetch-depth: 50
       - name: Fetch base ref for diff
         run: git fetch --depth=50 origin "${BASE_REF}:refs/remotes/origin/${BASE_REF}"
         env:
           BASE_REF: ${{ github.event.pull_request.base.ref }}
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444  # v5.0.0
         with:
           node-version: '24'
       - name: Run docs-required lint

.github/workflows/test.yml

@@ -132,10 +132,10 @@ jobs:
             scope: windows
 
     steps:
-      # actions/checkout@v6 uses includeIf.gitdir: to inject auth on Windows.
-      # On Windows git 2.54, the gitdir path comparison is unreliable, so use
-      # v4 on Windows and v6 elsewhere.
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2 (Windows)
+      # Windows lane on checkout v5.0.1 (drops includeIf; no auth flake, uses Node 24 natively).
+      # v6 uses includeIf.gitdir: for auth injection; on Windows git 2.54 the path comparison is
+      # unreliable (https://github.com/actions/checkout/pull/2425). v5 never used includeIf.
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd  # v5.0.1 (Windows)
         if: runner.os == 'Windows'
         with:
           fetch-depth: 0
@@ -231,7 +231,7 @@ jobs:
             shell: 'zsh {0}'
 
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2 (Windows)
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd  # v5.0.1 (Windows)
         if: runner.os == 'Windows'
         with:
           fetch-depth: 0