chore(ci): move GitHub Actions and CI Node.js to 24

[mbroton]

Problem

• Every action in the workflows ran on the deprecated Node.js 20 runtime, and
  GitHub forces them onto Node.js 24 with a warning.
• CI and the release smoke test installed the worker on Node.js 20, but the
  Playwright base image (mcr.microsoft.com/playwright:v1.64.1) ships
  Node.js 24. CI did not test the runtime we ship.
• Dependabot did not track GitHub Actions, so the versions went stale.

Change

• Update each action to its newest major, which runs on Node.js 24:

  Action	Old → new
  actions/checkout	v4 → v7
  actions/setup-go	v5 → v7
  actions/setup-node	v4 → v7
  actions/upload-pages-artifact	v3 → v5
  actions/deploy-pages	v4 → v5
  docker/build-push-action	v6 → v7
  docker/setup-buildx-action	v3 → v4
  docker/setup-qemu-action	v3 → v4
  docker/login-action	v3 → v4
  docker/metadata-action	v5 → v6
  softprops/action-gh-release	v2 → v3

  The release notes of every major in between show no input that these
  workflows use as renamed or removed, and no default that they rely on as
  changed.

• Use node-version: '24' in ci.yml and release.yml.

• Add a weekly, grouped Dependabot update for GitHub Actions.

Impact

• No change to the server, worker, images, or documentation.
• The website deploy runs on merge, because this PR changes website.yml.
  That run exercises upload-pages-artifact v5 and deploy-pages v5.
• The publish job in release.yml (login, metadata, QEMU, and release
  actions) runs only on a version tag, so the next release exercises it.

Verification

• Worker tests on Node.js 24: 51 of 51 pass. Typecheck passes.
• Bench script checks and scripts/check-playwright-version.js pass.
• actionlint v1.7.7: no new findings. It reports two SC2034 warnings
  (unused retry-loop variable) that also exist on main.