chore: Merge CI changes from neqo

[Not-Nik]

No description provided.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
⚠️ Please upload report for BASE (main@71eeddf). Learn more about missing BASE report.

Additional details and impacted files

@@           Coverage Diff           @@
##             main      #47   +/-   ##
=======================================
  Coverage        ?   68.89%           
=======================================
  Files           ?       26           
  Lines           ?     3244           
  Branches        ?     3244           
=======================================
  Hits            ?     2235           
  Misses          ?      806           
  Partials        ?      203           

Flag	Coverage Δ
freebsd	68.89% <ø> (?)
linux	68.89% <ø> (?)
macos	68.89% <ø> (?)
windows	68.89% <ø> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[github-actions]

This PR ports CI improvements from neqo: bumps all vmactions/* VM actions to current versions, adds copyback: true for artifact retrieval, installs bindgen tooling on all BSD platforms, and wires up a new bindgen-args input to generate + diff-check bindings inside the VM (with artifact upload for downstream consumption). It also adds a push trigger to the actionlint workflow.

The bindgen infrastructure is well-structured — the early-exit-on-drift pattern avoids wasting CI time compiling against stale bindings. A couple of minor items flagged inline (NetBSD formatting, artifact upload condition).

[github-actions]

Clean infrastructure PR porting CI improvements from neqo. The vmactions bumps and copyback: true additions are straightforward. The bindgen infrastructure (input, package installs, generate-diff-upload pipeline) is well-structured.

Key observation: the bindgen-args codepath is currently inert — no workflow passes the input — so none of the new bindgen logic will execute until a follow-up wires it up. This also means it can't be validated by CI from this PR alone.

The prior bot review's feedback on NetBSD ;; formatting and always() → !cancelled() is still unaddressed and worth fixing before merge.