CI workflows: remove leftover debug guards, EOL Node, outdated actions, pnpm version drift

Problem

The four workflows in .github/workflows/ have accumulated cruft and outdated pins:

• Leftover debug guards: static-linting.yml gates four steps on if: github.ref != 'refs/pull/11/merge' — a hardcoded reference to long-closed PR #11. It silently disables install+lint for that ref and confuses anyone reading the workflow.
• EOL Node for releases: release-zips.yml pins node-version: '16' (EOL since Sept 2023), so the shipped example zips are built on a runtime nobody develops against — while static-linting.yml uses 18/lts/*. .nvmrc says lts/*, which is not reproducible.
• Outdated actions: actions/checkout@v3 and actions/setup-node@v3 (deprecated runner Node), peter-evans/create-pull-request@v5 (v7 current). Only github-contributors.yml is on checkout v4.
• pnpm version drift: release-zips.yml pins pnpm 8.7.1, static-linting.yml pins 8, and package.json has no packageManager field to act as the source of truth.
• No dependency caching in any workflow (setup-node without cache).
• Release noise: release-zips.yml cuts a new dated release and re-tags latest on every push to trunk — including docs-only commits — re-uploading ~30 zips for a README typo.
• Minor: release-zips.yml runs sudo apt-get install -y gh although gh is preinstalled on ubuntu-latest, and mkdir -p zips duplicates the make-dir zips step inside npm run deploy.

Proposed fix

1. Remove the refs/pull/11/merge guards from static-linting.yml.
2. Pin .nvmrc to 22 and switch all workflows to node-version-file: '.nvmrc' — one source of truth for local dev, lint, and release builds.
3. Bump actions/checkout and actions/setup-node to v4 everywhere; peter-evans/create-pull-request to v7.
4. Add "packageManager": "pnpm@<pinned version>" to package.json and make both workflows install pnpm from it (e.g. pnpm/action-setup with no version input).
5. Enable cache: pnpm in setup-node.
6. Path-filter the release-zips.yml push trigger to build inputs (e.g. plugins/**, package.json, pnpm-lock.yaml) so docs-only commits don't cut releases; keep workflow_dispatch as the manual escape hatch.
7. Drop the redundant gh install and mkdir -p zips steps.

Out of scope

• The new e2e CI workflow (#147).
• A build-freshness check for committed build/ directories (separate issue, coming).
• New lint dimensions (markdown lint, PHP compatibility matrix, _bin type-checking) — worth doing, but separate from this mechanical cleanup.

Start with .github/workflows/static-linting.yml and release-zips.yml, then inspect .github/workflows/github-contributors.yml, .nvmrc, package.json, and pnpm-lock.yaml for existing version conventions. Update the four workflows and package metadata as proposed, and verify that linting, dependency caching, manual releases, and path-filtered release triggers still work without release noise from documentation-only changes.