v0.16.2 — firefox-watch fix, templates off Node 20

Two fixes to the workflow templates that fxcss init ships. Both affect every theme that has run fxcss init — regenerate with fxcss init --force --watch --previews to pick them up.

firefox-watch has been silently failing

The weekly watch exists to catch a Firefox channel break before it reaches release. It was downloading firefox.dmg into the repo checkout and then staging its fix with git add -A, so the 150 MB dmg landed in the commit and GitHub's 100 MB limit rejected the push — on every channel, every week, with nothing to show for it but a red run.

WhiteSur's watch ran against Firefox 154 beta on Aug 17, four days before 154 broke captures. It found a real selector rename, wrote the patch, and died pushing it.

Now the dmg goes to $RUNNER_TEMP, and the fix is staged with git apply --index — exactly the files the patch touches, nothing else that a step might leave in the tree.

What the watch does and does not cover: it runs fxcss audit, so it catches selector renames. It does not exercise the capture pipeline, and would not have caught the 154 module move fixed in 0.16.1. The preview workflows cover that.

Templates off Node 20

The shipped templates were on checkout@v4 / setup-python@v5 / *-artifact@v4 / github-script@v7 — all Node 20, which GitHub's runners are retiring — while fxcss's own CI had moved on months ago. Dependabot bumps .github/workflows/ and does not know the templates hold the same actions.

All five now match what fxcss's CI runs (checkout@v7, setup-python@v7, upload-artifact@v7, download-artifact@v8, github-script@v9). A test pins the templates to the workflows so they cannot drift apart again, and another asserts no template action declares a Node 20 runtime.