ci: move off broken pnpm 11.12.0 and take the pending action majors

[dcondrey]

Closes the four stuck dependabot majors. They share one file set, so verifying them together costs one CI run instead of four.

pnpm 11.12.0 is deprecated upstream: "This release is broken. Please upgrade to v11.13.1 or newer." Its @pnpm/exe build shipped without a binary. That is why #19 failed — action-setup v6 installs @pnpm/exe, v4 installs plain pnpm, so v4 never touched the broken artifact:

Switching pnpm from v11.7.0 to v11.12.0...
[WARN] deprecated @pnpm/exe@11.12.0
[ERROR] Cannot use 'in' operator to search for 'integrity' in undefined

pnpm 11.20.0 itself refuses to run against a packageManager pin of 11.12.0. So the bump is required regardless of which action version we land on.

version: is dropped from all three workflows — packageManager in package.json is now the only place the pnpm version is written, so the two cannot drift again.

The one real breaking change is in #23, and it is silent: upload-pages-artifact v4.0.0 stopped including dotfiles, which would drop the .nojekyll that demo.yml writes two lines earlier. Restored with include-hidden-files: true.

• ci(deps)(deps): bump pnpm/action-setup from 4.3.0 to 6.0.9 #19 pnpm/action-setup v4 -> v6.0.10 (v6.0.9 in the PR; .10 bootstraps pnpm 11.19.0)
• ci(deps)(deps): bump actions/upload-artifact from 4.6.2 to 7.0.1 #20 upload-artifact v4 -> v7.0.1. name/path/retention-days all still present; new archive input defaults to the old behavior
• ci(deps)(deps): bump actions/upload-pages-artifact from 3.0.1 to 5.0.0 #23 upload-pages-artifact v3 -> v5.0.0, plus the dotfile fix above
• ci(deps)(deps): bump github/codeql-action/upload-sarif from 3.37.1 to 4.37.4 in the codeql group #27 codeql-action/upload-sarif -> v4.37.4, matching init/analyze. Also fixes the # v3 comment dependabot left on a v4 SHA
• ci(deps)(deps): bump actions/attest-sbom from 2.4.0 to 4.1.0 #28 attest-sbom v2 -> v4.1.0. Inputs unchanged; now a wrapper over actions/attest, which is worth migrating to separately

Verified locally on pnpm 11.20.0: --frozen-lockfile install clean, typecheck and lint green.

release.yml only runs on a v* tag, so #20 and #28 are not exercised here — those two are verified by reading the actions' action.yml input surfaces, not by a run. demo.yml is in its own paths filter and will deploy on merge, which does exercise #23.

review will fail as usual: dependency graph is disabled on this repo.