Update pinned actions in release-kit workflow (Node 20 runtime deprecation)

[cabljac]

The Release Kit workflow (.github/workflows/release-kit.yaml) emits this warning on runs:

Node 20 is being deprecated. This workflow is running with Node 24 by default. If you need to temporarily use Node 20, you can set the ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true environment variable. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

This is not about the node-version: "24" we pass to setup-node. The pinned action versions themselves declare a Node 20 runtime:

• actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 (v4)
• actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 (v4.4.0)

Fix

Bump both pins (in the test and release jobs) to the latest v5 releases, which run on Node 24. Keep full SHA pinning as we do now.

Notes

• Other workflows in the repo likely pin the same v4 SHAs and will warn too. Worth sweeping them in the same PR.
• Warning-only for now, but GitHub will remove the Node 20 runtime, at which point these runs fail.