fix(#445): upgrade Windows checkout v4→v5.0.1 + audit other @v4 floats (silence Node 20 deprecation warnings)

[trek-e]

Fix PR

Using the wrong template?
— Enhancement: use enhancement.md
— Feature: use feature.md

---

Linked Issue

Required. This PR will be auto-closed if no valid issue link is found.

Fixes #445

The linked issue must have the confirmed-bug label. If it doesn't, ask a maintainer to confirm the bug before continuing.

---

What was broken

GitHub Actions emitted Node 20 deprecation warnings on every CI run despite PR #350 setting FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true in test.yml. Per actions/runner src/Runner.Worker/JobExtension.cs, that env var doesn't silence the warning — it changes which warning fires (from 'running on Node.js 20' to 'target Node.js 20 but being forced to run on Node.js 24'). Both call context.Warning(). The only mechanism that fully silences is the action's own action.yml declaring using: node24.

What this fix does

• test.yml Windows checkout: SHA 11bd71901bbe5b1630ceea73d27597364c9af683 (v4.2.2) → 93cb6efe18208431cddfb8368fd83d5badbf9bfd (v5.0.1). Per v5 action.yml, v5 declares using: node24. Per upstream PR #2425, v5 does NOT use includeIf — auth-bug-free.
• test.yml comment lines 135-137 updated to reflect the v5 rationale.
• changeset-required.yml + docs-required.yml: @v4 → SHA-pinned v5.0.1 (checkout) and v5.0.0 (setup-node SHA a0853c24544627f65ddf259abe73b1d18a591444).
• Note: FORCE_JAVASCRIPT_ACTIONS_TO_NODE24 was already absent from origin/next's test.yml (only existed on main), so no env var removal was needed. Worth investigating why fix: opt test workflow JS actions into Node 24 #350 didn't land cleanly — surfaced as separate concern.

Root cause

Three workflow files referenced @v4 actions whose action.yml declares using: node20:

• .github/workflows/test.yml:138 + :234 (Windows lane in test job + test-full job) — pinned actions/checkout@v4.2.2 (SHA 11bd71901bbe5b1630ceea73d27597364c9af683). Per commit 925e8d953 (PR fix(ci): pin actions/checkout@v4 on Windows to bypass v6 includeIf auth bug #162) + issue bug(ci): actions/checkout@v6 fails on windows-latest with "could not read Username" #161 rationale: 'v6 uses includeIf.gitdir: to inject the auth token, but on Windows git 2.54 the gitdir path comparison fails non-deterministically, leaving the fetch unauthenticated.' Upstream confirms: actions/checkout#2425 — 'This was introduced in v6 with the move to credential isolation via includeIf (#2286). v5 did not use includeIf so it was never an issue.'
• .github/workflows/changeset-required.yml:19,22 — floating actions/checkout@v4 + actions/setup-node@v4.
• .github/workflows/docs-required.yml:19,22 — same.

Testing

How I verified the fix

• actionlint on all three workflow files: exit 0.
• gsd-test-summary --both -base next against commit cbbd9fe0: Mac 0 failed, Docker 0 failed.
• Policy linter (workflow-policy.cjs): 13/13 pass.
• CI on this PR is the authoritative Windows verification for the v5 auth-bug claim — only real CI can prove v5 doesn't reintroduce the issue bug(ci): actions/checkout@v6 fails on windows-latest with "could not read Username" #161 flake.

Regression test added?

• Yes — added a test that would have caught this bug
• No — explain why: CI workflow YAML changes; the actionlint + policy linter pass is the automated gate; a unit test cannot simulate GitHub Actions runner Node version selection.

Platforms tested

• macOS — gsd-test-summary --both -base next against commit cbbd9fe: Mac: 0 failed
• Windows (including backslash path handling)
• Linux — same: Docker: 0 failed
• N/A (not platform-specific)

Runtimes tested

• Claude Code
• Gemini CLI
• OpenCode
• Other: ___
• N/A (not runtime-specific)

---

Checklist

• Issue linked above with Fixes #NNN — PR will be auto-closed if missing
• Linked issue has the confirmed-bug label
• Fix is scoped to the reported bug — no unrelated changes included
• Regression test added (or explained why not)
• All existing tests pass (npm test)
• .changeset/ fragment added if this is a user-facing fix (npm run changeset -- --type Fixed --pr <NNN> --body "...") — or no-changelog label applied
• No unnecessary dependencies added

Breaking changes

None

---

References

• bug(ci): actions/checkout@v6 fails on windows-latest with "could not read Username" #161, PR fix(ci): pin actions/checkout@v4 on Windows to bypass v6 includeIf auth bug #162 (original v4 pin)
• fix: opt test workflow JS actions into Node 24 #350 (partial FORCE env var fix)
• Upstream actions/checkout#2425
• actions/runner FORCE_JAVASCRIPT_ACTIONS_TO_NODE24 implementation

---

^{Need help on this PR? Tag @codesmith with what you need. Autofix is disabled.}