ci: bump actions/checkout + actions/setup-node to v5 (drop Node 20 runtime)

GitHub deprecated the Node 20 action runtime, so checkout@v4 and setup-node@v4 were
force-run on Node 24 with a warning. v5 of both targets Node 24 natively; their inputs
are unchanged (ref/repository/token/fetch-depth/path; the build's node-version stays
'20', that's the project runtime not the action runtime). setup-php@v2 is the current
major and unaffected. ci-staging runs only on tag pushes, so the warning clears on the
next tagged release.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.github/workflows/ci-staging.yml

@@ -10,14 +10,14 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - uses: shivammathur/setup-php@v2
         with:
           php-version: '8.3'
           coverage: none
       - run: composer install --no-interaction --prefer-dist --no-progress
       - run: cp .env.example .env && php artisan key:generate
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v5
         with:
           node-version: '20'
       - run: npm ci

.github/workflows/promote-public.yml

@@ -15,13 +15,13 @@ jobs:
     environment: production
     steps:
       - name: Checkout private repo at the tag
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           ref: ${{ inputs.tag }}
           fetch-depth: 0
           path: src
       - name: Checkout public repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           repository: ${{ vars.PUBLIC_REPO_SLUG }}
           token: ${{ secrets.PUBLIC_REPO_TOKEN }}

.github/workflows/promote-stable.yml

@@ -18,7 +18,7 @@ jobs:
     environment: production
     steps:
       - name: Checkout private repo at the beta tag
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           ref: ${{ inputs.betaTag }}
           fetch-depth: 0
@@ -27,7 +27,7 @@ jobs:
         run: |
           git -C src tag "${{ inputs.stableTag }}" "${{ inputs.betaTag }}^{commit}"
       - name: Checkout public repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           repository: ${{ vars.PUBLIC_REPO_SLUG }}
           token: ${{ secrets.PUBLIC_REPO_TOKEN }}

.github/workflows/yank.yml

@@ -21,7 +21,7 @@ jobs:
           echo "$TAG" | grep -qE '^v[0-9]+\.[0-9]+\.[0-9]+(-beta[0-9]+)?$' \
             || { echo "refusing to yank an unrecognised tag: $TAG" >&2; exit 1; }
       - name: Checkout public repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           repository: ${{ vars.PUBLIC_REPO_SLUG }}
           token: ${{ secrets.PUBLIC_REPO_TOKEN }}