GitHub Actions versions are stale across most workflows

Audited 2026-07-29 (prompted by a similar finding in another toolbox
repo). docs.yml's actions have been bumped to current majors as part of
the same change that fixed the Image sidebar bug (see git history), but
the rest of .github/workflows/ was deliberately left alone — bumping
release.yml touches the real PyPI publish pipeline and deserves its own
careful pass (verify the actual release workflow file, don't just bump
and hope), not a drive-by alongside a docs fix.

download-artifact and upload-artifact are the standouts — 3-4 majors
behind, both used in release.yml's build→publish artifact handoff. Most
of these actions/* majors turned out to be low-risk (mainly Node.js
runtime bumps: v24 requires Actions Runner ≥ v2.327.1, a non-issue on
GitHub-hosted runners), confirmed while bumping docs.yml, but
download-artifact/upload-artifact v4→v7/v8 haven't been checked for
breaking input/output changes yet — do that before bumping release.yml.

Note: the mamba-org/setup-micromamba row is moot once the separate
conda/micromamba-removal work lands — don't bump that one, just delete it.

Fix

For each remaining workflow file, check that action's release notes
between the pinned and latest major for actual breaking changes (not just
Node runtime bumps), then bump. Do release.yml last and most carefully
— it's the one that actually publishes to PyPI. Re-run
.github/workflows/ci.yml on a real PR after bumping it, since it's the
main test gate.

Start by inspecting .github/workflows/ci.yml, release.yml, release-please.yml, and commitlint.yml, then read release notes for each pinned action between its current and target major. Verify release.yml’s artifact handoff and PyPI publishing workflow especially carefully, and delete the obsolete setup-micromamba entry rather than bumping it. Done means the applicable actions are safely updated and a real PR reruns .github/workflows/ci.yml successfully.