Migrate GitHub Actions to Node 24 and tighten release permissions

[jpmartins98]

Summary

Migrate CI and release workflows away from deprecated Node 20 actions, remove an upstream Buffer() deprecation warning, and apply least-privilege token permissions.

Problem

GitHub is retiring Node 20 for JavaScript actions. The existing workflow versions produce deprecation warnings and will increasingly depend on temporary compatibility behavior.

The current artifact download path also emits Node DEP0005. Investigation traced it to actions/download-artifact through @actions/artifact -> unzip-stream, which still invokes the deprecated new Buffer() constructor. The download succeeds, but the warning remains in otherwise successful release logs.

Finally, contents: write is currently granted globally, including to jobs that only need to check out code and build artifacts.

Changes

• Upgrade actions/checkout to v7.
• Upgrade actions/setup-python to v7.
• Upgrade actions/upload-artifact to v7.
• Upgrade softprops/action-gh-release to v3.
• Pin astral-sh/setup-uv v9.0.0 to its immutable commit SHA.
• Replace actions/download-artifact with the documented gh run download command.
• Update the release file glob for the per-artifact directories created by GitHub CLI.
• Enable fail_on_unmatched_files so an empty or malformed release cannot silently succeed.
• Change workflow-level permissions to contents: read.
• Grant only the publishing job actions: read and contents: write.
• Do not use ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION or suppress deprecation warnings.

Why this PR is needed

This keeps the workflows compatible with GitHub's Node 24 migration, removes obsolete transitive Node code from the release path, and reduces the impact of a compromised build step by withholding repository write access from build jobs.

Compatibility and scope

There are no application runtime changes. Build profiles, Python dependencies, artifact names, checksums, and supported operating systems remain unchanged.

Validation

• Local suite: 114 passed, 2 skipped.
• Release v0.3.1.dev6: all 10 jobs succeeded.
• All Windows, macOS, AppImage, Flatpak, ARM64, and legacy smoke tests succeeded.
• The release publisher downloaded and published 28 assets using gh run download.
• Combined validation with all proposed PRs: 118 passed, 2 skipped.
• Workflow YAML parsed successfully and contains no Node 20 fallback.

References

• GitHub Node 20 deprecation: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
• GitHub CLI artifact download: https://cli.github.com/manual/gh_run_download

AI disclosure

This PR and all changes introduced by it, including workflow code, investigation, and this description, were generated by OpenAI Codex under the user's direction. The resulting changes were reviewed through source inspection and real GitHub Actions release validation.