ci: bump actions/checkout v4 -> v6 (Node 24 readiness)

GitHub forces the Node 24 runtime on 2026-06-16; checkout@v4 runs on the deprecated Node 20. checkout v6.0.2 declares runs.using: node24. All 9 usages (5 in build.yml, 4 in release.yml) are bare checkouts with no inputs, so the major bump is a drop-in.

Still on Node-20-era majors in release.yml, deferred (multi-major jumps with breaking changes, and release.yml only runs on tag push): upload-artifact v4->v7, download-artifact v4->v8, softprops/action-gh-release v2->v3.

.github/workflows/build.yml

@@ -25,7 +25,7 @@ jobs:
         flavor: [default, debug]
     name: build (${{ matrix.cc }} / ${{ matrix.flavor }})
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: install build deps
         run: |
@@ -84,7 +84,7 @@ jobs:
     runs-on: ubuntu-latest
     name: sanitizers (ASan + UBSan)
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: install deps
         run: |
           sudo apt-get update -qq
@@ -115,7 +115,7 @@ jobs:
     name: clang-tidy
     continue-on-error: true
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: install deps
         run: |
           sudo apt-get update -qq
@@ -141,7 +141,7 @@ jobs:
     runs-on: ubuntu-latest
     name: drift-check (CISA KEV + Debian tracker)
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: cve_metadata drift
         run: |
           # Exits 1 if the federal data has drifted from our committed
@@ -168,7 +168,7 @@ jobs:
     runs-on: ubuntu-latest
     name: static-build
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: install build deps
         run: |
           sudo apt-get update -qq