ci: fetch the bundle and the site in the write jobs without a JavaScript action #430

What

After the job split, the two jobs that hold a write token still run two pinned GitHub actions: actions/checkout, which they need in order to push, and actions/download-artifact, which unpacks the archive that the read-only job uploaded. Replace actions/download-artifact in those jobs with a step that uses only git, shell and the GitHub CLI or REST API, or upload the version bundle as a single file that needs no unpacking.

Why

Every update of the download-artifact pin puts new action code into a job that holds the push token (version-bump.yml) or the documentation job's write token (docs.yml). The actions are GitHub's own and are pinned to exact commits, so this risk is accepted for now. This issue removes it.

Scope

• push in version-bump.yml and deploy in docs.yml.
• The jobs' checks of what they download stay as they are.
• The token stays off disk while untrusted content is unpacked or read.

Done when

• No action other than actions/checkout runs in a job that holds a write token.
• The release and documentation flows behave as before.

Related: #418