#3607 Migrate GitHub Actions workflows off deprecated Node 20 runtimes

GitHub Actions workflows reference actions that declare the deprecated Node.js 20 runtime, including a nested dependency in Codecov v5. Update these dependencies to Node 24-compatible releases while preserving the existing Java 21 build, workflow triggers, permissions, and runner images.

GitHub currently schedules Node 20 removal from Actions runners for September 23, 2026: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

Changes prepared locally

These changes are prepared in a local working tree; they have not been submitted as a pull request or merged.

File	Change
`.github/workflows/maven-ci.yml`	Upgrade checkout v4 → v5, setup-java v4 → v5, Sonar cache v4 → v5, and Codecov v5 → v7. Remove the redundant Maven cache step; setup-java already manages Maven caching.
`.github/workflows/maven-pr-builder.yml`	Upgrade checkout v4 → v5, setup-java v4 → v5, and Codecov v5 → v7. Remove the redundant Maven cache step.
`.github/workflows/stale.yml`	Upgrade stale v9 → v10.
`.github/dependabot.yml`	Add weekly `github-actions` updates alongside the existing weekly Maven updates.

The GitHub-maintained action upgrades use the smallest major-version changes that introduce Node 24. Codecov v7 incorporates the Node 24-compatible github-script dependency introduced in v6 and the updated uploader verification-key source introduced in v7.

Release references:

Remaining dependency: Presubmit

.github/workflows/presubmit.yml uses presubmit/ai-reviewer@latest. Both that reference and the newest published release checked, v0.2.5, still declare runs.using: node20: https://github.com/presubmit/ai-reviewer/blob/v0.2.5/action.yml

The prepared changes leave this workflow unchanged. An upstream Node 24-compatible release, or a separately tested replacement, is still needed to remove this remaining deprecated runtime declaration. Forcing a runtime override alone would not establish compatibility.

Validation performed

actionlint 1.7.12 passed with external ShellCheck and Pyflakes integration disabled. The local ShellCheck shim was unavailable.
YAML parsing and Dependabot configuration checks passed.
Confirmed that updated action references resolve, their configured inputs are supported, and their declared runtimes—including Codecov's nested github-script action—use Node 24.
Confirmed that workflow triggers, permissions, runner images, and shell commands match the original workflows.
Confirmed that each Maven workflow retains setup-java's Maven cache.
git diff --check passed.

GitHub-hosted workflow execution has not yet been tested. The Node 24 actions require Actions runner v2.327.1 or newer; the workflows use GitHub-hosted Ubuntu runners.

Completion criteria

Submit and review the prepared workflow and Dependabot changes.
Confirm the Java PR build and coverage upload on GitHub-hosted runners.
Confirm the master build, Sonar analysis, coverage upload, and scheduled stale workflow after merge.
Resolve Presubmit's remaining Node 20 runtime declaration with a verified compatible release or replacement.