chore: upgrade actions to Node 24 runtime (SHA-pinned)

[John C. Bland II (johncblandii)]

what

• Bump GitHub Actions references in the workflows to versions running on the Node 24 runtime,
  SHA-pinned with precise version comments:
  • actions/checkout@v4 → @3d3c42e5... # v7.0.1
  • actions/setup-go@v5 → @b7ad1dad... # v7.0.0
  • goreleaser/goreleaser-action@v5 → @f06c13b6... # v7.2.3

why

• GitHub is deprecating the Node 20 runtime; affected workflows emit a deprecation warning and
  are already being force-migrated to Node 24
• SHA pinning with a verified tag comment makes the upgrade deliberate and supply-chain-safe,
  matching the org's direction in chore: upgrade actions to Node 24 runtime and enforce SHA pinning .github#261
• Every pinned SHA was verified against its upstream tag
• goreleaser-action inputs in use (distribution, version, args) are unchanged in v7.
  Note: the workflow uses version: latest, which already resolves GoReleaser v2.x today, while
  .goreleaser.yml has no version: 2 key — flagging as a pre-existing concern unrelated to
  this pin (behavior is unchanged by this PR).

references

• https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

still on Node 20

• mszostok/codeowners-validator@v0.7.1 — Docker-based action (no Node runtime), not covered by
  this upgrade matrix; left as-is

[Copilot]

Pull request overview

Updates workflow action references to SHA-pinned revisions that run on the Node 24 runtime, aligning the repo with GitHub’s Node 20 deprecation guidance and improving supply-chain safety via immutable pins.

Changes:

• Pin actions/checkout to a specific commit SHA with a tag comment (# v7.0.1) in affected workflows.
• Pin actions/setup-go to a specific commit SHA with a tag comment (# v7.0.0) in the build workflow.
• Pin goreleaser/goreleaser-action to a specific commit SHA with a tag comment (# v7.2.3) in the build workflow.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
.github/workflows/validate-codeowners.yml	Pins actions/checkout to a SHA to ensure Node 24 runtime compatibility and supply-chain safety.
.github/workflows/build.yml	Pins checkout, setup-go, and goreleaser-action to SHAs to avoid mutable tags and align with Node 24 runtime.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[John C. Bland II (johncblandii)]

Follow-up on the flagged goreleaser concern (dae3958): .goreleaser.yml is now migrated to the v2 schema (version: 2, archives[].formats, changelog.disable) and validated with the same GoReleaser v2.17.1 binary CI installs — without this, the v7 action bump would have broken the next release, as it did in github-status-updater/slack-notifier/github-commenter CI. Left untouched for maintainers: the pre-existing binary: atmos value in builds, which looks like a copy-paste leftover (release binaries get named atmos instead of github-authorized-keys) — changing artifact naming is a maintainer call. The org fallback config has the same migration in cloudposse/.github#267.