ci: bump the github-actions group across 1 directory with 5 updates - #103

Takes the five action bumps from Dependabot #85, with each pinned SHA verified against the upstream tag it claims and the two-major attest-build-provenance jump read through its changelog first. #85 can be closed once this lands.

What changed

Every SHA was resolved with git ls-remote --tags against the upstream repo, not taken on trust from the bump description. All five match. v4.1.1 of attest-build-provenance is a lightweight tag pointing straight at the commit, so the pin is the commit itself.

actions/attest-build-provenance 2.4.0 → 4.1.1 — the one worth reading

CI cannot exercise this path (publish.yml only runs on a tag push), so the changelog was read rather than inferred from a green check. Three things actually changed across the two majors:

1. v3 moved to the node24 runtime. GitHub-hosted ubuntu-latest ships a runner with node24, so this is a non-event here.
2. v3 added create-storage-record, defaulting to true. It emits an Artifact Metadata Storage Record and wants an artifact-metadata: write scope, which neither publish.yml nor dev-nightly.yml grants. This is a non-issue on two independent counts: actions/attest calls GET /repos/{owner}/{repo} first and skips the path entirely unless the repo owner is an Organization — tyler-rich is a User — and even when it does run, a permission failure is a core.warning, not a step failure. No permission change is needed.
3. v4 reduced the action to a thin wrapper over actions/attest. Upstream now points new workflows at actions/attest directly, but the wrapper stays supported and its inputs are unchanged. Switching is a separate, deliberate change, not something to smuggle into a version bump.

The inputs this repo passes — subject-name, subject-digest, push-to-registry — are all still present and behave the same. The v2 predicate sub-action that disappeared was never referenced here. Both points are noted inline next to the step so the next reader doesn't have to re-derive them.

The other four

• setup-python 7.0.0 removes the pip-install input and drops EOL Python versions; this repo passes python-version: "3.14" and cache: pip, neither affected.
• setup-node 7.0.0 removes a dummy NODE_AUTH_TOKEN export and migrates to ESM; this repo passes node-version: "22" and cache: npm, neither affected.
• checkout 7.0.1 is bugfixes only (--unset escaping, branch-name whitespace trimming).
• login-action 4.5.1 adds Docker Hub OIDC support, which does not touch the GHCR username/password login used here.

Verification

• All four workflow files and the composite action parse as YAML.
• CI is the real gate for checkout/setup-python/setup-node/login-action — every one of them runs on this PR.
• attest-build-provenance is not covered by this PR's CI. It is exercised by dev-nightly.yml, so a workflow_dispatch of the nightly after this merges will run the bumped action against a real GHCR push before the v0.2.0 tag depends on it.