ci: upgrade actions/checkout and setup-node to v6, node to 24

[stack72]

Summary

• Upgrade actions/checkout from v4 to v6 across all 6 workflow files (16 occurrences)
• Upgrade actions/setup-node from v4 to v6 in ci.yml (2 occurrences)
• Bump node-version from 22 to 24 in ci.yml (2 occurrences: skill-review, skill-trigger-eval jobs)

Breaking Change Analysis

actions/checkout v4 → v6

Change	Version	Impact
Node 20 → 24 runtime	v5	None — GitHub-hosted runners handle automatically
Credentials stored in $RUNNER_TEMP instead of .git/config	v6	None — no workflows parse .git/config directly
No input/output API changes	—	Drop-in replacement

actions/setup-node v4 → v6

Change	Version	Impact
always-auth input removed	v6	None — not used in any workflow
Auto-caching enabled for npm by default	v5	None — no packageManager field in package.json
Auto-caching narrowed to npm only	v6	None — no explicit caching configured
devEngines.runtime precedence over engines.node	v6.3	None — we use explicit node-version, not node-version-file

Node 22 → 24

Node 24 is the current LTS. Used only for npm install -g @anthropic-ai/claude-code and skill review scripts — no compatibility concerns.

Why this is correct

Both upgrades were verified to be safe for our specific usage patterns:

• All runners are GitHub-hosted (no self-hosted runner version concerns)
• No workflows use always-auth, packageManager in package.json, custom mirrors, or .git/config parsing
• setup-node usage is minimal — just installing a Node version for npm CLI usage

Test plan

• CI passes on this PR (self-validating — these workflows run on the PR itself)
• Verify checkout step succeeds across all jobs
• Verify skill-review and skill-trigger-eval jobs install Node 24 and run successfully

🤖 Generated with Claude Code

[github-actions]

Code Review

Blocking Issues

None.

Suggestions

None — this is a clean, well-documented version bump. The breaking change analysis in the PR description is thorough and the changes are consistent across all workflow files.

[github-actions]

CI Security Review

Critical / High

None.

Medium

None. All upgraded actions (actions/checkout, actions/setup-node) are GitHub-owned first-party actions, which are acceptable with tag-only pins per our policy. No third-party actions were changed.

Low

None.

Verdict

PASS — This PR is security-neutral. It only bumps GitHub-owned action tags (v4 → v6) and the Node.js version (22 → 24). No new triggers, permissions, secrets, expressions, or LLM prompt changes are introduced. No attack surface is added or modified.