ci: bump actions to Node 24 runtime versions

[Sayan-]

Summary

GitHub forces JS actions onto Node 24 on 2026-06-16 (Node 20 removed 2026-09-16). Bump the pinned actions across the three workflows that use them to their Node 24 majors:

Action	Before	After
actions/checkout	v4	v6
actions/setup-go	v5	v6
actions/setup-node	v4	v6
actions/create-github-app-token	v1	v3
goreleaser/goreleaser-action	v6	v7

create-github-app-token inputs (app-id/private-key/repositories) and goreleaser-action inputs are unchanged across these majors (goreleaser-action v7 is a runtime-only bump). GitHub-hosted runners already meet the v2.327.1 minimum.

Validation

• test.yaml runs on pull_request, so the checkout + setup-go bumps are exercised by this PR's check run.
• release.yaml only runs on a v* tag, so its bumps (goreleaser-action, setup-node, release-path create-github-app-token/checkout) are not exercised here — they'll be confirmed on the next release.
• fix-ci.yaml is a workflow_run workflow (runs from the default branch), so its bumps take effect after merge.

Made with Cursor

---

Note

Low Risk
Workflow-only version pin updates with no application or secret-handling logic changes; release and fix-ci bumps are not fully exercised until tag push and merge.

Overview
Bumps pinned GitHub Actions in fix-ci, release, and test workflows to majors that run on Node 24, ahead of GitHub’s deprecation of Node 20 for JS actions.

test.yaml and fix-ci.yaml move actions/checkout to v6 and actions/setup-go to v6; fix-ci and release also bump actions/create-github-app-token to v3. release.yaml additionally upgrades actions/setup-node to v6 and goreleaser/goreleaser-action to v7. Step inputs (app-id, private-key, go-version-file, GoReleaser args, etc.) are unchanged.

This PR’s CI run exercises the test workflow bumps; release and post-merge fix-ci paths are validated on tag push and default-branch workflow runs respectively.

^{Reviewed by Cursor Bugbot for commit c8e4874. Bugbot is set up for automated code reviews on this repo. Configure here.}

[firetiger-agent]

Firetiger deploy monitoring skipped

This PR didn't match the auto-monitor filter configured on your GitHub connection:

PRs in the kernel, infra, hypeman, and hypeship repos. kernel is a ~mono repo with many logical services underneath, ensure to focus on the implicated service for the PR

Reason: This PR only modifies CI/CD workflow files and GitHub Actions versions, not the actual service code or infrastructure requiring deploy monitoring.

To monitor this PR anyway, reply with @firetiger monitor this.