fix(ci-cd): bump github actions to node 24 runtimes

[piyushsinghgaur1]

Description

GitHub Actions runs in this repository were emitting the annotation:

Node.js 20 is deprecated. Please update to a supported Node.js version. For more information see: https://github.blog/changelog/2025-09-19-github-actions-transitioning-from-node-20-to-node-24/

actions/checkout@v4 and actions/setup-node@v4 declare using: node20 in their action.yml, so the runner executed them on the deprecated Node 20 action runtime. The v5 majors of both declare using: node24. This PR bumps those pins and moves the release job onto Node 24.

Each target major was verified to actually be on node24 before bumping:

gh api "repos/actions/checkout/contents/action.yml?ref=v5"    | ... -> using: node24
gh api "repos/actions/setup-node/contents/action.yml?ref=v5"   | ... -> using: 'node24'

Action pin changes

File	Action	Was	Now
.github/workflows/main.yaml	actions/checkout	@v4	@v5
.github/workflows/main.yaml	actions/setup-node	@v4	@v5
.github/workflows/release.yaml	actions/checkout	@v4	@v5
.github/workflows/release.yaml	actions/setup-node	@v4	@v5
.github/workflows/sync-docs.yaml	actions/checkout (Checkout Extension Code)	@v4	@v5
.github/workflows/sync-docs.yaml	actions/checkout (Checkout Docs Repository)	@v4	@v5
.github/workflows/trivy.yaml	actions/checkout	@v4	@v5

Node version changes

File	Field	Was	Now
.github/workflows/release.yaml	node-version (Setup Node)	'22'	'24'
.github/workflows/main.yaml	node-version matrix	[22, 24]	[22, 24] (unchanged)

Also removed the now-inaccurate trailing # UPDATED to v4 comment on the setup-node step in release.yaml.

Deliberately left unchanged

• main.yaml CI matrix node-version: [22, 24] — it already includes Node 24, so it does not cause the annotation. Dropping 22 would reduce test coverage for consumers still on Node 22, so the matrix is untouched.
• aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 — third-party action pinned by commit SHA for supply-chain reasons. Re-pointing it is out of scope for this change and it is not what the Node 20 annotation refers to.
• No actions/github-script, actions/setup-python, actions/upload-artifact or actions/cache usages exist in this repo, so there was nothing else to bump and no legacy Octokit :owner/:repo route placeholders to migrate.

Fixes #280

Type of change

• Bug fix (non-breaking change which fixes an issue)

How Has This Been Tested?

• Verified each bumped action major declares using: node24 via the GitHub contents API (output above), so the deprecation annotation is actually resolved rather than just moved.
• Validated all four workflow files still parse as YAML (js-yaml load of main.yaml, release.yaml, sync-docs.yaml, trivy.yaml — all OK).
• Confirmed the commit touches only the four workflow files and nothing else.
• Runtime confirmation of a clean annotation-free run — pending, this can only be observed once CI runs on this PR (and release.yaml / sync-docs.yaml only trigger on workflow_dispatch / push to master respectively, so they will be exercised after merge).

Checklist:

• Performed a self-review of my own code
• npm test passes on your machine — not applicable, this change is CI configuration only and touches no source code; the CI workflow itself runs npm run test on Node 22 and 24.
• New tests added or existing tests modified to cover all changes — not applicable, workflow YAML is not unit-testable; correctness was verified by the action runtime check and YAML parse above.
• Code conforms with the style guide
• API Documentation in code was updated — not applicable, no public API surface changed.
• Any dependent changes have been merged and published in downstream modules — not applicable, no dependent changes.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud