chore: extend bump to remaining Node 20 actions/* (setup-python, upload/deploy-pages, etc.)

Second pass on the Node 24 transition — first pass covered checkout/setup-node/
upload-artifact/download-artifact/cache/github-script; this pass adds the
remaining actions/* that were still on Node 20.

Bumps:
- actions/setup-python v5 -> v6.2.0 (a309ff8)
- actions/upload-pages-artifact v3/v4 -> v5.0.0 (fc324d3)
- actions/deploy-pages v4 -> v5.0.0 (cd2ce8f)
- actions/configure-pages -> v6.0.0 (45bfe01) [already latest in this org]
- actions/setup-dotnet v4 -> v5.2.0 (c2fa09f)
- actions/attest-build-provenance v1 -> v4.1.0 (a2bbfa2)
- actions/dependency-review-action v4 -> v5.0.0 (a1d282b)

All seven moved to Node 24 runtime in their latest stable releases; runner
requirement v2.327.1+ is met by github-hosted runners.

Breaking-change notes:
- upload-pages-artifact v4 excluded hidden dotfiles by default (not _-prefixed
  paths). Astro/Vite '_astro/' output is unaffected; .well-known/ would be.
- attest-build-provenance v2 introduced multi-subject attestation (single
  attestation per call instead of per-artifact). Backward-compatible for
  typical single-subject usage.

SHA + version-comment pinning convention preserved.

Author: mcp-tool-shop

.github/workflows/pages.yml

@@ -35,7 +35,7 @@ jobs:
         working-directory: site
         run: npm run build
 
-      - uses: actions/upload-pages-artifact@v4
+      - uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
         with:
           path: site/dist