Bump GitHub Actions off Node 20 before the forced runtime removal

[rtunazzz]

Every workflow run now warns:

Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, actions/upload-artifact@v4, astral-sh/setup-uv@v5

Runners are already forcing these onto Node 24, so this is currently cosmetic — but the compatibility shim goes away eventually, and every action pinned in this repo is behind. Not urgent; filing so it isn't discovered during a release.

Current state

Action	Pinned	Latest
actions/checkout	v4	v7.0.1
actions/upload-artifact	v4	v7.0.1
actions/download-artifact	v4	v8.0.1
actions/setup-java	v4	v5.6.0
astral-sh/setup-uv	v5	v9.0.0
android-actions/setup-android	v3	v4.0.1
softprops/action-gh-release	v2	v3.0.2

Affects both .github/workflows/release.yml and .github/workflows/android-ci.yml.

Watch out when doing this

These are multi-major jumps, not routine bumps. Two spots in release.yml depend on specific artifact-action behaviour and need re-verifying rather than assuming:

1. sign job relies on actions/download-artifact@v4 extracting each artifact matched by pattern: unsigned-macos-* into its own subdirectory named after the artifact — the script reads unsigned/unsigned-macos-arm64/tools and unsigned/unsigned-macos-$arch/. If v8 changes that layout, the job breaks.
2. release job relies on pattern: release-* with merge-multiple: true flattening into one directory, asserted by test "$(find release-assets -maxdepth 1 -type f | wc -l)" -eq 9.

softprops/action-gh-release v2 → v3 also needs a look, since it's what actually publishes the release and its assets.

Testing

release.yml now has a workflow_dispatch trigger that runs validate, windows, and both macOS builds while skipping sign and release. That covers most of the upgrade — but note it deliberately skips the two jobs containing the artifact-layout dependencies above, so those still need a real tagged release to verify.