chore: upgrade first-party actions to node24 majors

[mattpartida]

Summary

Addresses the GitHub Actions Node 24 deprecation warning (backlog item 8). All first-party actions in this repo ran on the deprecated node20 runtime: actions/checkout@v4 and actions/setup-python@v5 in the CI workflow and both examples/ci/github-actions/ copyable downstream examples.

What changed

• .github/workflows/ci.yml — actions/checkout@v4 → @v7, actions/setup-python@v5 → @v7 (both v7 majors run on node24; verified via action.yml using: node24 on the release tags).
• examples/ci/github-actions/agent-security-strict.yml and agent-security-sarif.yml — same upgrades so copied downstream workflows don't inherit node20 deprecation warnings.
• tests/test_ci_actions_versions.py (new) — guards that runnable workflows only use allow-listed first-party actions at node24-compatible majors, and that stale node20-era refs (checkout@v1–v4, setup-python@v1–v5) never reappear; also checks the changelog/docs stay in sync.
• docs/ci-integration.md — new "Action runtime versions" section explaining the node24 guidance for downstream users.
• CHANGELOG.md — documentation-only-updates entry (CI tooling only; no scanner behavior change).

Safety notes

• actions/setup-python@v7 removed the unused pip-install input; this repo's workflows don't use it (they use python-version only), so no breakage.
• actions/checkout@v7 is ESM-based with security fixes (blocks fork-PR checkout for pull_request_target/workflow_run); no inputs used here changed.
• github/codeql-action/upload-sarif@v4 is already the latest major and left untouched.
• The examples/schema-adapters/github-actions-*.json fixtures are scanner inputs, not runnable workflows — left unchanged deliberately.
• No scanner behavior, JSON output fields, or skill content changed.

Test Plan

Local verification (Python 3.11.15, matching CI):

• python -m compileall -q skills tests — OK
• python -m pytest -q — 92 passed (89 prior + 3 new, TDD: confirmed red before the upgrade, green after)
• ruff check . — All checks passed
• ./package-skills.sh — packaged both skills
• git diff --check — clean
• CI on this PR exercises the upgraded actions/checkout@v7 / setup-python@v7 steps end to end

[mattpartida]

Refreshed this PR against latest main:

• Merged origin/main (resolved a CHANGELOG.md conflict in Unreleased → Documentation-only updates).
• Extended the node24 majors (actions/checkout@v7, actions/setup-python@v7) to the two downstream examples added to main after this branch opened: agent-security-compare-reports.yml and agent-security-prompt-sarif.yml. The existing regression test in tests/test_ci_actions_versions.py now also guards those files.
• Local verification: compileall OK, pytest 150 passed, ruff check . clean, package-skills.sh + package_skills.py --check OK, git diff --check clean.