Transitive actions target Node 20 (deprecated) — action.yml pins setup-python / cache / setup-node / upload-artifact at node20 versions

Thanks for maintaining this action. `action.yml` on current `main` (`0c6a49f1fa56a1d472575da86a94dbc1edb78eda`) pins five first-party actions at `node20`-runtime versions. GitHub has deprecated Node 20 ([changelog](https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/)) and is currently force-running them on node24; when node20 support is removed, the action will fail.

| `action.yml` line | Pin | Runtime |
|---|---|---|
| 72 | `actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065` (v5.6.0) | node20 |
| 79 | `actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830` (v4.3.0) | node20 |
| 152 | `actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830` (v4.3.0) | node20 |
| 159 | `actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020` (v4.4.0) | node20 |
| 310 | `actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02` (v4.6.2) | node20 |

**Impact on consumers:** every run that uses this action gets a `Node.js 20 is deprecated…` warning annotation on its check, and a future node20 removal breaks the action. Since this repo publishes no tagged releases, consumers pin to a `main` commit and can't remediate these transitive pins themselves — a fix has to land here.

**Suggested fix:** bump each to its current node24-targeting major (e.g. `actions/setup-node@v5`, `actions/upload-artifact@v5`, `actions/cache@v5`, `actions/setup-python@v6` — please verify the current majors), keeping the existing SHA-pin + version-comment style.

Happy to send a PR if that's useful.