ci: align release.yml action versions with sync-check

[MANVENDRA-github]

Why

Dependabot's github-actions group bumped sync-check.yml (PR #15). release.yml was added after dependabot.yml landed but before that bump reached it, so the two workflows pinned different majors of the same two actions:

sync-check.yml   actions/checkout@v7   actions/setup-node@v6
release.yml      actions/checkout@v5   actions/setup-node@v5

Nothing was broken — v5 still runs. But a repo shipping a supply-chain-security skill should not have two workflows disagreeing about which major of an action they trust, and Dependabot's next grouped PR would have surfaced them as separate, confusing bumps.

After

release.yml      actions/checkout@v7   actions/setup-node@v6
sync-check.yml   actions/checkout@v7   actions/setup-node@v6
node-version: 24  x4 jobs

A caveat worth stating

release.yml only triggers on a v* tag push, so this PR's CI does not exercise it. The evidence that v7/v6 work is sync-check.yml, which has been green on them since PR #15 and uses the same two actions the same way. The next tag will be the first real run.

Not changed, on purpose

release.yml calls gh release create without --latest=false, so GitHub marks the newest-created release as "Latest" rather than the highest version. That is correct for a normal release (you tag ascending) and only misbehaves when back-filling an old tag — which happened once, was corrected with gh release edit v0.15.0 --latest, and won't recur. Adding the flag would break the common case.

Verification

$ python -c "import yaml; d=yaml.safe_load(open('.github/workflows/release.yml')); print(d['permissions'])"
{'contents': 'write'}          # unchanged — release.yml genuinely needs it

$ npm run sync   # clean, no drift