Upgrade all GitHub Actions to current major versions

[kalwalt]

Summary

Every GitHub Action used in this repository is one major version behind current. #622 aligned
the two laggard workflows to the repository's existing standard, but that standard is itself
out of date.

Action	Repository uses	Latest
actions/checkout	v6	v7.0.1
actions/cache	v5	v6.1.0
actions/setup-node	v6	v7.0.0
actions/upload-artifact	v6	v7.0.1
actions/setup-python	v5	v7.0.0

Third-party actions are also worth reviewing: EndBug/add-and-commit@v10,
softprops/action-gh-release@v3, github/codeql-action/*@v4.

Why this is a separate piece of work

Action major bumps carry breaking changes — upload-artifact v3 → v4 being the well-known
example, where artifact behaviour changed in ways that silently broke workflows. The bumps
here touch:

• main.yml, which commits build artifacts back to master
• publish.yml, which publishes to npm on a tag
• codeql.yml, which gates security scanning

None of those fail in a way that is cheap to discover. publish.yml in particular only runs
on a tag push, so a break is found after the tag exists — the same failure shape as #619.

Suggested approach

• Read the release notes for each major bump before changing anything, rather than
  bumping and seeing what happens.
• Do CI.yml and codeql.yml first — they run on every push, so breakage surfaces
  immediately and costs nothing.
• Then build-python.yml.
• Then main.yml, checking that the artifact commit step still behaves.
• publish.yml last, and consider exercising it on a throwaway prerelease tag rather
  than a real release.

Notes

publish.yml also pins node-version: 22.15.1 while .nvmrc specifies 24.15.0 — tracked
separately.

Follow-up to #622.