Update pinned actions in release-kit workflow (Node 20 runtime deprecation)

The `Release Kit` workflow (`.github/workflows/release-kit.yaml`) emits this warning on runs:

> Node 20 is being deprecated. This workflow is running with Node 24 by default. If you need to temporarily use Node 20, you can set the ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true environment variable. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

This is not about the `node-version: "24"` we pass to setup-node. The pinned action versions themselves declare a Node 20 runtime:

- `actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683` (v4)
- `actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020` (v4.4.0)

**Fix**

Bump both pins (in the `test` and `release` jobs) to the latest v5 releases, which run on Node 24. Keep full SHA pinning as we do now.

**Notes**

- Other workflows in the repo likely pin the same v4 SHAs and will warn too. Worth sweeping them in the same PR.
- Warning-only for now, but GitHub will remove the Node 20 runtime, at which point these runs fail.

Start with .github/workflows/release-kit.yaml and inspect the test and release jobs. Update the two named action pins while keeping full SHA pinning, then search other workflows for the same v4 SHAs as suggested. Done means the affected workflows use v5 Node 24-compatible releases and no longer emit the Node 20 runtime warning.

Written by the indexing model from the issue text.