ci: opt into Node 24 early for all 3 workflows (blog-documented env)

GitHub Actions runners deprecate Node 20 on 2026-06-02 and auto-switch
to Node 24. Every run of our workflows currently emits the reminder
annotation on actions/checkout@v4, setup-python@v5, upload-artifact@v4.

Rather than chase six separate major-version bumps (checkout v4->v6,
setup-python v5->v6, upload-artifact v4->v7, cache v4->v5, codecov v4->v6,
download-artifact v3->?) — each a potential breaking change — use
GitHub's documented escape hatch: set FORCE_JAVASCRIPT_ACTIONS_TO_NODE24
as a workflow-level env var. Keeps existing action versions pinned,
just swaps the runtime.

Reference: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

Applied identically to all three workflows (ci-cd.yml, citation-audit.yml,
build-wheels.yml). Security: pure runner config, no user input flows
into run: blocks.

Verification: actionlint + yaml.safe_load pass on all 3.
Action version upgrades stay on the backlog for a separate dedicated
sprint where each bump can be tested in isolation.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: brycewang-stanford

.github/workflows/build-wheels.yml

@@ -38,6 +38,12 @@ on:
         type: boolean
         default: false
 
+# Opt into Node 24 runtime for JavaScript actions. GitHub's documented
+# migration path (2025-09-19 changelog) ahead of the 2026-06-02 hard
+# cutover. Preserves current action versions. No user input interpolated.
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: 'true'
+
 jobs:
   check_rust_present:
     name: Detect Rust crate

.github/workflows/ci-cd.yml

@@ -19,6 +19,14 @@ on:
           - both
         default: none
 
+# Opt into Node 24 runtime early for all JavaScript actions.
+# GitHub's documented migration path (blog post 2025-09-19) before the
+# hard cutover on 2026-06-02. Keeps existing action versions intact and
+# just swaps the runtime, so no surface-area change in our steps.
+# Security: pure runner config, no user input.
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: 'true'
+
 jobs:
   test:
     runs-on: ${{ matrix.os }}

.github/workflows/citation-audit.yml

@@ -57,6 +57,13 @@ on:
       - '.github/workflows/citation-audit.yml'
   workflow_dispatch:
 
+# Opt into Node 24 runtime early for all JavaScript actions.
+# GitHub's documented migration path (blog post 2025-09-19) before the
+# hard cutover on 2026-06-02. Keeps existing action versions intact.
+# Security: pure runner config, no user input.
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: 'true'
+
 concurrency:
   group: citation-audit-${{ github.ref }}
   cancel-in-progress: true