chore: upgrade actions to Node 24 runtime (SHA-pinned)

[John C. Bland II (johncblandii)]

what

• Bump GitHub Actions references in the workflows to versions running on the Node 24 runtime,
  SHA-pinned with precise version comments:
  • actions/checkout@v6 → @3d3c42e5... # v7.0.1
  • nick-fields/assert-action@v2 → @0efd6166... # v4.0.1

why

• GitHub is deprecating the Node 20 runtime; affected workflows emit a deprecation warning and
  are already being force-migrated to Node 24
• SHA pinning with a verified tag comment makes the upgrade deliberate and supply-chain-safe,
  matching the org's direction in chore: upgrade actions to Node 24 runtime and enforce SHA pinning .github#261
• Every pinned SHA was verified against its upstream tag

references

• https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

Supersedes #104
Supersedes #103

[Copilot]

Pull request overview

This PR updates GitHub Actions used by the repository’s test workflows to versions that run on the Node 24 runtime, using full SHA pinning with tag comments to improve supply-chain safety and make upgrades explicit.

Changes:

• Pin actions/checkout to the v7.0.1 commit SHA in all test workflows.
• Pin nick-fields/assert-action to the v4.0.1 commit SHA in all test workflows.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
.github/workflows/test-docker-build.yml	Pins actions/checkout and nick-fields/assert-action to verified SHAs for Node 24 runtime compatibility.
.github/workflows/test-docker-build-multi-platform.yml	Same SHA-pinned upgrades for the multi-platform test workflow assertions and checkout.
.github/workflows/test-docker-build-complex.yml	Same SHA-pinned upgrades for the complex build test workflow assertions and checkout.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Erik Osterman (Cloud Posse) (osterman)]

Approving. Test-workflows only; I read action.yml at head to confirm the publishing path is genuinely untouched — no changes to login, build-push, tag priority, platforms, or the secrets/secret-files passthrough. Both SHAs verified upstream.

Follow-up worth filing: this PR hardens the CI workflows while the published action.yml still floats every ref that handles registry credentials and produces artifacts — docker/metadata-action@v6, docker/login-action@v4, docker/setup-buildx-action@v4, docker/setup-qemu-action@v4, docker/build-push-action@v7, dcarbone/install-jq-action@v3.2.0, cloudposse/github-action-jq@v0.4.1. If #261's goal is real supply-chain hardening, that's the actual gap in this repo. Not a blocker for this PR.