ci: bump actions off the deprecated Node 20 runtime

[jcelerier]

Every job in Build Spatial Protocol Mapper currently emits:

Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, actions/upload-artifact@v4 …

The compatibility shim is temporary, so these bumps get us off it before it disappears.

Changes (.github/workflows/build.yml)

Action	Before	After
actions/checkout	v4	v7
actions/upload-artifact	v4	v7
actions/download-artifact	v4	v8
softprops/action-gh-release	v2	v3

action-gh-release@v2 is also pinned to Node 20 (v3 is the Node 24 line), it just wasn't surfaced in the annotations because the release job only runs on main/tags.

Breaking changes reviewed

All of these majors carry breaking-change notes; none affect this workflow:

• checkout v7 — blocks checking out fork PRs under pull_request_target / workflow_run. This workflow uses plain pull_request, so it's unaffected. v5/v6 were Node 24 + credential-storage changes.
• upload-artifact v7 — ESM rewrite plus an opt-in archive: false direct-upload mode. Default stays zipped, so the upload/download pairing is unchanged.
• download-artifact v5 — changed the output path for single downloads by ID. We download by pattern: app-* with merge-multiple: true, which was explicitly called out as unaffected.
• download-artifact v8 — ESM, plus digest-mismatch now defaults to error instead of a warning. That's a stricter integrity check on artifact download; it should only fire on genuine corruption, and erroring is the behaviour we want for release artifacts.

Hosted runners only (ubuntu/macos/windows-latest), so the ≥2.327.1 runner-version requirement of the Node 24 majors is already satisfied.

Not covered

• jcelerier/import-codesign-certs@master also shows in the macOS annotations, but it's pulled in by ossia/actions/custom-score-build, not by this repo — it has to be fixed upstream in ossia/actions.
• .github/workflows/claude.yml stays on actions/checkout@v6, which is already Node 24 and not deprecated.

Verification

This PR exercises checkout@v7 and upload-artifact@v7 on all four platforms. The release job is gated on tags/main, so download-artifact@v8 and action-gh-release@v3 won't run until this lands on main — the continuous release upload is the first real test of those two.

🤖 Generated with Claude Code

https://claude.ai/code/session_01HDpmynESrQrqCCKMuWNgYk