ci: update actions to Node 24 releases and gate audit on high severity

[rendis]

Node 24 action releases

GitHub deprecated the Node 20 runtime. The release runs warned that actions/checkout, actions/setup-node and pnpm/action-setup target Node 20 and were only running because the runner forced them onto Node 24. actions/setup-go v5 has the same problem.

The actions are now pinned by commit SHA to their current Node 24 releases:

Action	Before	After
actions/checkout	v4	v7.0.1
actions/setup-node	v4	v7.0.0
actions/setup-go	v5	v7.0.0
pnpm/action-setup	v4	v6.1.0

I checked each action's action.yml and breaking-change notes:

• Every input these workflows use still exists.
• None of the breaking changes apply here (ESM migration, default npm caching only for npm projects, always-auth removal, go.mod-based cache key).
• setup-node no longer writes the deprecated always-auth setting, which removes the Unknown user config "always-auth" warning from npm publishing.

No dependency cache in the npm publish job

setup-node recommends disabling the dependency cache in jobs with elevated permissions. The npm job has id-token: write and publishes packages, so it now sets package-manager-cache: false and drops the pnpm cache. That way, a poisoned cache entry cannot end up in a published package. The Quality jobs keep their cache.

pnpm audit --audit-level=high

At the low threshold, any new low or moderate advisory in any dependency blocked every pull request and every release, whether or not the change touched dependencies. High and critical advisories still fail the build. The current dependency tree passes at both levels.

Validation

• actionlint reports no issues.
• The Quality checks on this PR exercise checkout, setup-go, pnpm/action-setup and setup-node on the new versions.
• After merge, the release workflow on main plans target=none, because v3.4.0 and the Studio 0.2.0 packages are already published. That push also exercises the new checkout in the prepare job.