chore(deps): bump release workflow actions off Node 20

[scott]

The v0.5.0 release workflow emitted Node.js 20 deprecation warnings on every job — actions/checkout@v4, actions/setup-go@v5, actions/upload-artifact@v4, and actions/download-artifact@v4 are all forced onto Node 24 by GitHub. The softprops/action-gh-release@v2 step is also several majors behind.

What needs to bump

In .github/workflows/release.yml:

Action	Current	Latest	Notes
actions/checkout	v4	v7	majors since v4 include Node 24 default and fetch-depth: 0 behavior changes
actions/setup-go	v5	v7	Go version input format unchanged in practice, but check release notes
actions/upload-artifact	v4	v7	v5+ requires explicit if-no-files-found, paths are relative to GITHUB_WORKSPACE
actions/download-artifact	v4	v8	v5+ downloads into a per-artifact subdirectory, which the Flatten artifacts step already copes with via find
softprops/action-gh-release	v2	v3	input renames only

The release still succeeded despite the warnings, but the GitHub blog post linked from the warning implies Node 20 will eventually be unsupported on Actions runners entirely, so this is housekeeping.

How to verify

After bumping, the cheapest way to confirm is to push a temporary tag like v0.0.0-test and watch the resulting run — the script's --dry-run won't catch this since the warnings come from the runner.

Or temporarily add [skip ci] is not an option here; the workflow only triggers on v* tags. So either:

1. Cut a real prerelease tag (e.g., v0.5.1-rc.1) — heavier, but real
2. Replay the job from the Actions UI against the bumped commit

Related

• Deprecation notice: https://github.blog/changelog/2025-09-19/deprecation-of-node-20-on-github-actions-runners/