fix: suppress npm always-auth deprecation warning by upgrading to setup-node@v6

[jbrejner]

Summary

• Upgrades actions/setup-node from @v4 to @v6 in the release workflow
• Eliminates the npm warn Unknown user config "always-auth" deprecation warning that appears in release builds
• No behavioral change: the workflow uses npm with no packageManager field in any package.json, so v6's auto-caching restrictions don't apply

🤖 Generated with Claude Code

[claude]

Claude finished @jbrejner's task in 1m 47s —— View job

---

Review of PR #847

• Gather context and understand the change
• Run static analysis (go build, go vet, go mod tidy) — all pass
• Review the diff
• Post review feedback

Static Analysis

All checks pass — go build, go vet, and go mod tidy report no issues. (Expected, since only a workflow file changed.)

Code Review

Change: .github/workflows/release.yml line 148 — actions/setup-node@v4 → actions/setup-node@v6

Findings:

1. Correctness — This is the only setup-node reference in the repo, so the upgrade is complete. No stale v4 references remain.

2. PR description claim verified — None of the package.json files in npm/ contain a packageManager field, so setup-node@v6's auto-caching behavior (which requires packageManager) won't change anything. The upgrade is purely to suppress the always-auth deprecation warning.

3. No issues found — The surrounding config (node-version: '24', registry-url) is compatible with v6. No always-auth config exists in the repo (it was set internally by setup-node v4).

Summary

Clean, minimal change. The upgrade from v4 to v6 is well-motivated (suppresses a deprecation warning), correctly scoped (single reference, no behavioral change), and the PR description accurately documents the rationale and the lack of side effects. LGTM.