ci: move actions off the deprecated Node 20 runtime

[austenstone]

Every action in both workflows was pinned old enough that the runner was already force-migrating it and warning on every single run:

Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, actions/setup-node@v4

I only noticed because I read the annotations on a CI run rather than the green check.

action	from	to
actions/checkout	v4	v7
actions/setup-node	v4	v7
actions/configure-pages	v5	v6
actions/upload-pages-artifact	v3	v5
actions/deploy-pages	v4	v5

The two changes that could have broken things quietly

These majors contain two behaviour changes that fail silently rather than loudly, so I checked both against this repo instead of assuming:

setup-node v5 auto-caches off a packageManager field in package.json, in addition to an explicit cache: input — so you can end up with two cache cycles. This repo has no packageManager field, so package-manager-cache: false isn't needed.

upload-pages-artifact v4 stopped bundling dotfiles by default. If dist/ contained a .nojekyll, it would have vanished from the artifact and Jekyll would start eating underscore-prefixed paths. A built dist/ here has no dotfiles at all, so include-hidden-files isn't needed.

upload-pages-artifact and deploy-pages are a matched pair and move together. No new permissions: scopes are required — the existing contents: read / pages: write / id-token: write covers all five.

Not affected

checkout v7's headline change blocks fork checkouts under pull_request_target and workflow_run. Neither workflow uses those triggers.

Verification

npm run build clean, both workflows still parse, and the real test is this PR's own CI run — it exercises the new checkout and setup-node on the ci job. The Pages-specific three only run on push to main, so those get exercised on merge.