ci: bump pnpm/action-setup to v6.0.8 (Node 24 runtime)

The release workflow pinned pnpm/action-setup at b906affc (v4.3.0, despite
the stale "# v4.0.0" comment), which runs on Node.js 20. GitHub forces
Node 20 JS actions to Node 24 starting 2026-06-16 and removes the Node 20
runtime on 2026-09-16, so every Release run was emitting a deprecation
annotation.

Bump to v6.0.8 (0e279bb9, runs.using: node24). The `version: 10` input is
unchanged and still supported. SHA-pinned per CSO #10.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: Amos N.

.github/workflows/release.yml

@@ -18,7 +18,7 @@ jobs:
       # attacker run arbitrary code in our publish pipeline (which has the
       # OIDC token + npm Trusted Publisher access).
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.0.0
+      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
         with:
           version: 10
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0