housekeeping for 4.0

[ofloveandhate]

Small fixes collected for 4.0, each its own commit, so they can be reviewed and merged in one go instead of one pull request apiece. This description is a running list and grows as commits land.

Changes

• Every GitHub Action runs on Node 24. GitHub is removing Node 20 from its runners, and recent runs warned about it. Seven actions targeted an old runtime; each moves to its lowest major on Node 24: actions/setup-python v5→v6, conda-incubator/setup-miniconda v3→v4, actions/upload-artifact v5→v6, actions/download-artifact v5→v7 (v6 is still Node 20), docker/login-action v3→v4, docker/build-push-action v6→v7, and softprops/action-gh-release v1→v3 (v1 was Node 16). Each one's release notes were checked against the inputs these workflows pass: none has a breaking change beyond the runtime, which GitHub-hosted runners already support. FORCE_JAVASCRIPT_ACTIONS_TO_NODE24, which forced the old actions onto Node 24, is removed. One behaviour change to know about: since action-gh-release v2.4.1, a release whose body_path file is missing is published with an empty body instead of failing the job.
• Linux CI runs on Ubuntu 26.04, on both architectures, and names its version. GitHub's ubuntu-latest label becomes Ubuntu 26 from October 19, 2026. Every workflow now names ubuntu-26.04 (x86_64) and ubuntu-26.04-arm (aarch64) instead of ubuntu-latest, so a future image change is a deliberate edit. The wheels build inside the manylinux container and do not see the host; what moves is the Linux C++ test job, which compiles with the runner's own toolchain: GCC 13 → 15 and CMake 3.31 → 4.4, plus Ubuntu 26's apt versions of GMP, MPFR, Eigen and OpenMPI. Checked beforehand on aarch64 with conda-forge GCC 15.3 and CMake 4.4.3: the core and every C++ test suite build with no errors, and all ten suites pass, threaded and with OMP_NUM_THREADS=1. The wheel artifact is named from the OS, so wheels-ubuntu-latest-3.11 becomes wheels-ubuntu-26.04-3.11, renamed consistently in the job that uploads it and both docs jobs that download it; the Linux C++ ccache starts cold under the new name. (Two commits: a pin to 24.04, then the move to 26.04; reverting the second restores the pin.)
• A release checks its notes before building anything. The GitHub release publishes CHANGELOG.md's top block, which a one-line extraction used to cut out; it returned an empty string when the separator lines were missing, and nothing checked the block's version or date. tools/release_notes.py does the same extraction and fails when there is no top block, when its heading is not ## [X.Y.Z] - YYYY-MM-DD for the tag's version (typically still unreleased), when it has nothing under the heading, or when it exceeds GitHub's 125,000-character limit for a release description. publish.yml runs it in check_version, the release's first job, so an unready changelog fails a final release in seconds instead of after every wheel has built, and again to write the notes. Prereleases skip it (no GitHub release), and pull requests do not run it. tools/test_release_notes.py covers each failure and checks the extraction matches the old one-liner on the real CHANGELOG. Today the check fails, correctly, because 4.0.0 is still unreleased.
• The Linux development environment compiles with GCC 15. environment.yml pinned gxx==13.3.0; it is now gxx==15.3.0, matching the GCC 15 that CI's Linux C++ jobs use on Ubuntu 26.04, so code that builds for a developer builds in CI. No workflow uses this file.
• CLAUDE.md records what the 4.0 preparation settled: CI's Linux C++ jobs compile with GCC 15 (and a compiler change needs a fresh build directory); how the plot refresh works (scripts run in their image folder, plots fail unless every image was written, refresh and doctest records go under python/docs/build, emptied each run); a records session lasts the process (ADR-0066); a wheel is not ABI-coupled to a user's own eigenpy, only source builds against shared libraries are; and developing means a real editable install.
• The GitLab mirror sync workflow is removed. Mirroring to GitLab is handled outside this repository's workflows now. The workflow ran on every push to every branch and did nothing where the GITLAB_* secrets were unset; nothing else referred to it.

🤖 Generated with Claude Code

[ofloveandhate]

there is some math in this one -- namely, that cauchy can now truncate in the same way as PSEG, for security-level truncation. i experienced the difference in the work i am doing on the cellular decomposition algoirthm using b2, and so wanted the same behaviour regardless of the endgame i am using.

there are additionally CI improvements that I hope will make relasing smoother, and let me not have to change runner setup for a while.