ci: bump GitHub Actions to Node 24-compatible majors

[yonromai]

Summary

• GitHub is migrating runners from Node.js 20 to Node.js 24 (forced June 2 2026, Node 20 removed September 16 2026). Workflows — including the marin-canary-ferry-cw run I manually triggered — emit deprecation warnings on actions/checkout@v4, actions/setup-python@v5, docker/login-action@v3, and docker/setup-buildx-action@v3. Each has a Node-24 successor major, so I bumped them:
  • actions/checkout v2/v3/v4 → v5
  • actions/setup-python v4/v5 → v6
  • docker/login-action v2/v3 → v4
  • docker/setup-buildx-action v3 → v4
• Also bumps versions that actionlint flags as "too old to run on GitHub Actions" (Node-16-era) to match the majors already used elsewhere in the repo:
  • google-github-actions/setup-gcloud v1 → v2
  • google-github-actions/auth v1 → v2
  • actions/cache v3 → v4
• actions/checkout@v6 in claude-review.yml was left alone (already past v5).

Not touched

• actions/cache@v4, actions/upload-artifact@v4, actions/download-artifact@v4, actions/setup-node@v4, actions/github-script@v7 — these are still on Node 20 but their maintainers will migrate the existing major in place (no Node-24 successor major released yet). They keep working until September 16 2026.

References

• GitHub changelog: Node 20 deprecation
• actions/checkout v5.0.0 release notes (Node 24)
• actions/setup-python v6, docker/*-action v4: all switched to Node 24

Test plan

• actionlint .github/workflows/*.yaml .github/workflows/*.yml (done locally — only remaining diagnostics are pre-existing shellcheck style notes inside run: blocks and the tpu-ci self-hosted-runner label)
• Manually trigger marin-canary-ferry-cw and confirm the Node 20 deprecation warning is gone
• Let scheduled workflows (unit tests, docker-images, etc.) run a cycle on main after merge to verify the newer action majors don't break anything

🤖 Generated with Claude Code