ci: fix Node 20, lint permission, and formatting annotations

[woensug-choi]

CI reports Node 20 deprecations, check-run creation failures (403), and a missing YAML document marker. The lint wrapper also returns success by default when formatting fails, while its formatter versions differ from pre-commit.

This PR fixes those issues together:

• Upgrade JavaScript actions in Docker builds, PR image publishing, and lint to verified Node 24 releases. Keep ShellCheck on a versioned composite action.
• Replace wearerequired/lint-action with direct Black, Flake8, and clang-format checks under a read-only token. This removes the Checks API writes that fail on fork PRs and restricted tokens. Failures now fail the job, while the other lint steps still run.
• Match Black, Flake8, and clang-format versions/settings to pre-commit, eliminating the existing formatter disagreement without reformatting source files.
• Add the missing --- to the MAVROS YAML configuration.
• Preserve the Docker Desktop socket when isolating credentials on the ARM64 runner, with an explicit connection check before Buildx setup.
• Fetch only the pinned ArduPilot revision and its submodules in the ARM64 image, with up to three attempts per transfer. This addresses the TLS interruption / early EOF in ARM run 36504996927 without changing the source revision.
• Add a Pages workflow on Ubuntu 26.04 with Node 24-compatible actions. It preserves the existing Jekyll build from the ros2 repository root and only deploys from ros2; PRs only build and upload a preview artifact. This replaces the GitHub-generated Pages workflow that also emits Node 20 and ubuntu-latest migration annotations.

Validation

• Before the ArduPilot download fix: live AMD64, lint, and Pages builds passed at 56311df; ARM64 passed Docker setup and the DAVE workspace build, then failed on an interrupted full ArduPilot clone. At cfae083, lint and Pages passed. The first ARM attempt failed before any workflow step because runner gwon-yeseol-mbp-arm64 was missing System.Net.WebSockets; a retry is running on ioess-MacBook-Pro. Full Docker validation remains pending.

• The updated download shell block passes syntax and ShellCheck; retry behavior was verified for immediate success, recovery after two failures, and failure after three attempts. A fresh execution of the exact Dockerfile download block succeeded; the parent commit and all 20 recursive submodules were verified against their pinned revisions.

• Actionlint (including ShellCheck) and workflow YAML lint passed.

• Black: all 19 Python files unchanged; Flake8 and clang-format checks passed.

• Repository YAML, shell, and CMake checks passed (13 CMake files).

• Action manifests were checked for runs.using: node24, including the artifact action nested inside the Pages uploader.

• XML lint retains its existing Gazebo namespace diagnostics; no XML source or namespace semantics are changed.

Pages activation after merging

In Settings → Pages → Build and deployment → Source, select GitHub Actions, then run Build and deploy Pages on ros2. The existing Pages source is ros2 /; repository settings have not been changed by this PR. This setting is needed to retire the generated legacy workflow and its uneditable warnings.

Self-hosted runners must support Node 24 (Actions Runner 2.327.1 or newer); current logs already show Node 24 execution. Old run annotations are historical and will remain visible; the fixes apply to new runs.