RED-198334 Bump GH Actions off Node 20 (unstable)

[gonen-red]

Summary

RED-198334. Bump GitHub Actions still running on Node 20 ahead of the June 16, 2026 deprecation deadline.

This PR is the canonical fix on unstable. The same changes will be cherry-picked to all 9 protected release/* branches (per inventory, 8 are identical; release/8.0 has 5 additional sites in build_release_automation.yml that get bumped on top of this CP).

Companion PR on master: #525. master has a separate templating-only codebase; this PR covers the release automation that lives on unstable and the release/* branches.

• Bump first-party actions: actions/checkout@v4 -> @v6 (16 sites), actions/upload-artifact@v4 -> @v7 (5 sites), actions/download-artifact@v4 -> @v7
• Bump docker/* actions: setup-buildx v3->v4 (3 sites), login v3->v4 (4 sites), build-push v6->v7 (2 sites)
• Bump dorny/test-reporter v2->v3, peter-evans/create-pull-request v7->v8, iarekylew00t/verified-bot-commit v1->v2

Test plan

• PR run of pull-request.yml builds + tests cleanly with bumped actions
• release_build_and_test.yml workflow_dispatch run produces same image digests
• release_publish.yml workflow_dispatch run creates verified tags and metadata PR via peter-evans/create-pull-request@v8

---

Note

Medium Risk
Touches release publish, Docker build/push, and verified commits; failures would block PR CI or releases but there is no runtime product code change.

Overview
Bumps GitHub Actions across composite actions and workflows so runners no longer depend on Node 20 ahead of GitHub’s June 2026 deprecation (RED-198334).

First-party: actions/checkout v4→v6, actions/upload-artifact v4→v7, actions/download-artifact v4→v7 in PR, build/test, release build, and release publish paths.

Docker: setup-buildx-action v3→v4, login-action v3→v4, build-push-action v6→v7 wherever images are built or pushed.

Third-party: dorny/test-reporter v2→v3, peter-evans/create-pull-request v7→v8, iarekylew00t/verified-bot-commit v1→v2 for verified release commits and official-images PRs.

No application or Dockerfile logic changes—only action version pins.

^{Reviewed by Cursor Bugbot for commit 6557a2b. Bugbot is set up for automated code reviews on this repo. Configure here.}