Update GitHub Actions off the deprecated Node.js 20 runtime

[refaim]

Every action in the workflow targeted Node.js 20, which GitHub has deprecated. Runs were already being force-migrated to Node.js 24, annotating every job with a deprecation warning.

action	from	to
actions/checkout	v4	v7
actions/setup-python	v5	v7
actions/cache	v4	v6
actions/upload-artifact	v4	v7
actions/download-artifact	v4	v8
codecov/codecov-action	v5	v7
softprops/action-gh-release	v2	v3
astral-sh/setup-uv	v5	v10.0.1

Notes on the two non-obvious ones

setup-uv is pinned to an exact version on purpose. It stopped publishing major and minor tags in v8, as a supply-chain hardening measure after the tj-actions compromise — astral-sh/setup-uv@v10 returns a 404 and would fail the workflow immediately. Hence the exact v10.0.1 and the comment above the step. Of the breaking changes across v6–v10, none touch this workflow: the removed pyproject-file/uv-file/server-url inputs were never used here, and the rest are cache-behaviour defaults.

download-artifact v5 carried a breaking change, but it only affects downloading a single artifact by ID. The release job downloads all artifacts at once, so each still lands in a directory named after its artifact and the mv snapjaw-*/… steps are unaffected. v8 additionally makes a digest mismatch fail instead of warn, which is the behaviour you want for release assets.

Checked that every input the workflow passes still exists in the target versions — setup-python kept architecture, cache kept path/key, upload-artifact kept name/path.

What CI here does and does not prove

check, build-windows and build-linux exercise checkout, setup-uv, setup-python, cache, upload-artifact and codecov on both Windows and Linux.

The release job is gated on if: github.event_name == 'push', so download-artifact@v8 and action-gh-release@v3 are not exercised by this PR and will first run on the merge to master. That is why both are covered by the reasoning above rather than by a green check. If the release job does fail, it fails after the build artifacts are already produced, so nothing is lost beyond a re-run.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (3ed2d2b) to head (6f277f7).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff            @@
##            master       #54   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files            5         5           
  Lines          583       583           
  Branches        97        97           
=========================================
  Hits           583       583           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.