ci: upgrade actions to Node 24 runtimes

[JOY (JOY)]

Summary

• upgrade all JavaScript-based GitHub Actions that still use the Node 20 runtime to their latest Node 24 major
• keep the application Node.js version at 22.14.0
• preserve all workflow inputs and behavior
• keep the Docker Hub description action pinned to the v5.0.0 commit SHA

Upgrades

• actions/checkout: v4 to v7
• actions/setup-node: v4 to v7
• actions/upload-artifact: v5 to v7
• actions/download-artifact: v5 to v8
• actions/github-script: v7 to v9
• pnpm/action-setup: v4 to v6
• docker/setup-buildx-action: v3 to v4
• docker/login-action: v3 to v4
• docker/metadata-action: v5 to v6
• docker/build-push-action: v6 to v7
• peter-evans/dockerhub-description: pinned v4 commit to pinned v5.0.0 commit

Compatibility evidence

• every updated action declares runs.using: node24
• all workflows use GitHub-hosted runners
• every configured input remains present in the new action versions
• repository scripts do not use the removed require('@actions/github') pattern from github-script v9
• CodeQL v4 already uses Node 24 and is unchanged

Validation

• git diff --check
• no old Node 20 action refs remain
• actionlint exits 0 when filtering only its known parallel-step parser message
• the diff contains only action reference updates
• Docker publishing is not manually dispatched because that would push external images; input compatibility is reviewed statically and the next tag release will provide live publisher validation

CI baseline fix

• Expand the existing cspell exclusion from docs/*.vi.html to docs/**/*.vi.html so JOY-facing Vietnamese reports under docs/reports/ remain valid inputs.
• This addresses the 671 cspell findings exposed when the PR moved from draft to ready; it does not change application runtime behavior.