ci: bump GitHub Actions to Node 24-compatible major versions

[gawbul]

Summary

• Updates all actions that GitHub flagged as Node 20-deprecated in the v0.3.4 release run, ahead of the 2026-06-16 forced-upgrade date.
• All bumps are major-version bumps, but compatible with current usage:
  • `softprops/action-gh-release@v3` is purely a Node 20 → Node 24 runtime bump.
  • `upload-artifact@v7` / `download-artifact@v8` add opt-in features (direct uploads, hash-mismatch enforcement) but keep the default zip behavior the workflow relies on.
  • `checkout@v6`, `setup-python@v6`, `cache@v5` are routine major bumps with no API changes affecting our usage.
• Left `coverallsapp/github-action@master` alone — it wasn't in the deprecation warnings, and re-pinning that is a separate hygiene task.

Bumps

Action	Before	After
`actions/checkout`	v4	v6
`actions/setup-python`	v5	v6
`actions/cache`	v4	v5
`actions/upload-artifact`	v4	v7
`actions/download-artifact`	v4	v8
`softprops/action-gh-release`	v2	v3

Test plan

• PR CI (`pull_request.yaml`) passes across the 3.10–3.14 matrix — exercises `checkout`, `setup-python`, `cache`
• On the next tag push, `push_tag.yaml` end-to-end succeeds — exercises the artifact actions and `action-gh-release`

🤖 Generated with Claude Code