chore: update GitHub Actions runtimes

[zhuangya]

Summary

• update GitHub Actions workflows from Node 20-based action versions to Node 24-compatible versions
• run CI and publish jobs on Node 24
• add explicit least-privilege workflow permissions
• format existing test files that failed the repository's current format:check CI step

Details

This updates:

• actions/checkout@v4 → actions/checkout@v7
• pnpm/action-setup@v4 → pnpm/action-setup@v6
• actions/setup-node@v4 → actions/setup-node@v6
• node-version: 20.x → node-version: 24.x

It also adds explicit workflow token permissions:

• CI: contents: read
• Publish: contents: write, pull-requests: write

Validation

• Parsed both workflow YAML files locally
• Ran git diff --check
• Checked there are no remaining Node 20 / old v4 action references in .github/workflows
• Ran pnpm run ci locally

I intentionally did not add a publish environment gate here, to avoid changing the current release approval flow.