CI: actions still on deprecated Node 20 — coordinate the dependabot bumps #117

Every Windows release run now carries this annotation:

Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, actions/setup-python@v5, actions/upload-artifact@v4, softprops/action-gh-release@v2

A warning today, but they are running on a runtime they were not built for, and the forcing will not last indefinitely.

Dependabot already has PRs open for all of them:

• Bump actions/checkout from 4 to 7 #96 actions/checkout 4 → 7
• Bump actions/setup-python from 5 to 7 #108 actions/setup-python 5 → 7
• Bump actions/upload-artifact from 4 to 7 #98 actions/upload-artifact 4 → 7
• Bump softprops/action-gh-release from 2 to 3 #107 softprops/action-gh-release 2 → 3
• Bump actions/setup-node from 6 to 7 #97 actions/setup-node 6 → 7

Worth reviewing, not blind-merging

#107 (action-gh-release v2 → v3) touches the release step directly. That step was changed in #110 to publish windows/RELEASE_NOTES_<version>.md via body_path alongside generate_release_notes: true. A major version bump can change how those two interact, and the failure mode is a release published with the wrong body — which is exactly what #110 set out to fix.

#98 (upload-artifact v4 → v7) matters less but the artifact paths changed in #111 when the portable download became a zip.

Suggest merging the uncontroversial ones first (checkout, setup-python, setup-node), then #107 on its own, then cutting a throwaway tag or a workflow_dispatch run to confirm the release body still comes out right before it matters for a real release.