Bump actions/checkout and actions/setup-python to node24 versions

[djkees]

Summary

Bumps every action in CEA's workflows that still declares node20 in its own action.yml, ahead of GitHub's removal of the Node20 compatibility shim for Actions runners on 2026-09-23. Started as the checkout/setup-python fix from #165, then expanded after auditing every uses: in the workflow files against its actual declared runtime (not just the two flagged in the original issue).

Fixes #165

Changes

Straightforward version bumps (all confirmed node24, changelogs checked for behavior changes against CEA's actual usage — none found):

• actions/checkout@v4/@v6 → @v7 (all occurrences)
• actions/setup-python@v5 → @v7
• actions/upload-artifact@v4 → @v7
• actions/download-artifact@v4 → @v8
• actions/upload-pages-artifact@v3 → @v5
• actions/deploy-pages@v4 → @v5
• softprops/action-gh-release@v2 → @v3

One dependency swap: ilammy/msvc-dev-cmd@v1 → step-security/msvc-dev-cmd@v1. The ilammy action has no node24 release and its upstream repo has had no commits since April 2024. step-security/msvc-dev-cmd is a verified drop-in mirror (same inputs/usage) maintained by StepSecurity, a supply-chain security vendor, with an active maintenance history. This closes CEA's own direct usage of ilammy/msvc-dev-cmd.

Not fixed here — tracked separately: fortran-lang/setup-fortran@v1 also pins ilammy/msvc-dev-cmd@v1.13.0 internally for its own Windows/Intel setup, so the windows-latest / msvc / intel job in bindc is still exposed via that transitive path regardless of this PR. That's not fixable from CEA's side — see #167 and fortran-lang/setup-fortran#275, where the same swap is proposed for setup-fortran's internal pin.

Testing

• Not run locally — CI-only, mechanical changes. Validated in the fork across three PRs (Bump actions/checkout and actions/setup-python to node24 versions djkees/cea#299, #301, #302), each with a full green CI run on the same build/test matrix this PR uses, including the windows-latest / msvc / intel job under the new step-security/msvc-dev-cmd action.

Compatibility / Numerical behavior

• No expected changes to numerical results

---

Drafted with Claude's assistance.

• Verified via gh release list/gh release view that each bumped action's target version is the first to declare node24, and read each release's changelog for behavior-affecting changes (not just runtime bumps) against CEA's actual with: inputs.
• Verified step-security/msvc-dev-cmd is maintained by an established security vendor with an active commit history (not an anonymous fork) before proposing it as a dependency swap.
• Confirmed the diff only touches action version pins/references (git diff upstream/main..HEAD -- .github/workflows/) — no other workflow logic changed.
• Each fork PR (Bump actions/checkout and actions/setup-python to node24 versions djkees/cea#299, #301, #302) ran the full CI matrix and passed before being cherry-picked here, including the specific job (windows-latest / msvc / intel) that exercises the msvc-dev-cmd swap.

🤖 Generated with Claude Code