ci: update first-party actions to latest majors

checkout v4.3.1 -> v7.0.1, setup-node v4.4.0 -> v7.0.0, stale v9.1.0 -> v10.4.0.

The breaking changes across those majors do not apply here:
- checkout v5/v6 harden `pull_request_target` checkouts; no workflow uses it
- setup-node v5 auto-caches when package.json has a `packageManager` field;
  it has none, and `cache: npm` is set explicitly anyway
- setup-node v7 drops the dummy NODE_AUTH_TOKEN export; the publish job sets
  NODE_AUTH_TOKEN itself
- stale v10 only moves the runtime to node 24

All of them also raise the runtime to node 24, which clears the deprecation
warnings on recent runs.

.github/workflows/nodejs.yml

@@ -15,10 +15,10 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4.3.1
+      - uses: actions/checkout@v7.0.1
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4.4.0
+        uses: actions/setup-node@v7.0.0
         with:
           node-version: 24
           cache: npm

.github/workflows/release-please.yml

@@ -38,10 +38,10 @@ jobs:
       contents: read
       id-token: write
     steps:
-      - uses: actions/checkout@v4.3.1
+      - uses: actions/checkout@v7.0.1
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4.4.0
+        uses: actions/setup-node@v7.0.0
         with:
           # node 24 bundles npm 11.16, over the >= 11.5.1 that trusted publishing needs
           node-version: 24

.github/workflows/stale.yml

@@ -12,7 +12,7 @@ jobs:
   stale:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@v9.1.0
+      - uses: actions/stale@v10.4.0
         with:
           stale-issue-message: >
             This issue has been automatically marked as inactive due to lack of