chore: upgrade actions to Node 24 runtime (SHA-pinned)

[John C. Bland II (johncblandii)]

what

• Bump GitHub Actions references to Node 24 runtimes, SHA-pinned with precise version comments:
  • actions/checkout@v4 → @3d3c42e5...# v7.0.1
  • nick-fields/assert-action@v2 → @0efd6166...# v4.0.1
  • cloudposse/github-action-jq@0.4.0 → @aff18a1f...# v0.4.1 (0.4.0 runs node20; v0.4.1 is node24)

why

• GitHub is deprecating the Node 20 runtime; these refs emit deprecation warnings for every
  consumer and are being force-migrated to Node 24
• SHA pinning with verified tag comments matches the org's supply-chain direction
  (chore: upgrade actions to Node 24 runtime and enforce SHA pinning .github#261); every pinned SHA was verified against its upstream tag
• Opened from a fork — direct branch push to this repo is not permitted for this account

references

• https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
• Supersedes Renovate Update actions/checkout action to v7 #42 (checkout v7) and Update nick-fields/assert-action action to v4 #41 (assert-action v4)

still on Node 20

• 1arp/create-a-file-action@0.3 in action.yml — no node24 release exists (latest 0.4 is
  node20); needs replacement, tracked org-wide

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[John C. Bland II (johncblandii)]

Maintainer note: this account cannot add labels from a fork — please apply the patch label (action.yml changed, so this ships to consumers) so the release-label validator passes.

[John C. Bland II (johncblandii)]

CI triage: the failing CI / test (*) matrix jobs are a structural fork-PR limitation, not a defect in the change. This repo's test harness (shared-ci-github-action.yml) uses convictional/trigger-workflow-and-wait to workflow_dispatch the test workflows on the PR branch — but fork PRs run with a read-only GITHUB_TOKEN, so the dispatch API call returns 403 (visible in the job logs at the first curl call), and the branch being dispatched only exists in the fork besides. Every check that can run for a fork passes: lint, context, and mergify Summary are green.

To get full CI: a maintainer with write access can recreate the branch in this repo (gh pr checkout 44 && git push origin HEAD:chore/node24-runtime-upgrade) and open/retarget the PR from it — or review-merge on the basis that the diff is three SHA-pinned version bumps with each SHA verified against its upstream tag. (Same ask as before: please add the patch label — forks can't label.)