ci: bring the new vendor workflows onto the node24 pins

Reconciles with ecb1075, f3432ed and ea9cef8, which landed on main while
this branch was open. The two new workflows were written against the
pins that were current when the branch was cut, so after the rebase they
were the only two files left on actions/checkout v4, setup-node v4,
pnpm/action-setup v6 and a literal node-version: 24.

Nothing would have failed. That is the point: a stale pin does not go
red, it just quietly runs an older action, so this is exactly the kind of
drift a rebase carries in without reporting it.

Both jobs check out the repository, so they read the version from .nvmrc
like everything else. The one remaining literal is release-vale.yml's
publish step, which deliberately has no checkout for the file to be read
from and documents that in place.

Every workflow now resolves each action to a single SHA.

Author: theCodeDrift

.github/workflows/ast-grep-upgrade.yml

@@ -80,12 +80,12 @@ jobs:
     steps:
       # Credentials persist because this job pushes a branch. It holds no npm
       # identity and no id-token.
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 24
+          node-version-file: .nvmrc
 
       # No dependency install: sg-detect.cjs is zero-dependency CommonJS, and
       # the lockfile step below needs pnpm rather than node_modules.

.github/workflows/vale-upgrade.yml

@@ -64,12 +64,12 @@ jobs:
     steps:
       # Credentials persist because this job pushes a branch. It holds no npm
       # identity and no id-token.
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 24
+          node-version-file: .nvmrc
 
       # No dependency install: the script is zero-dependency CommonJS, and the
       # lockfile step below needs pnpm rather than node_modules. GITHUB_TOKEN is