chore(deps): bump actions/setup-node from 5 to 6

[dependabot]

Bumps actions/setup-node from 5 to 6.

Release notes

Sourced from actions/setup-node's releases.

v6.0.0

What's Changed

Breaking Changes

• Limit automatic caching to npm, update workflows and documentation by @​priyagupta108 in actions/setup-node#1374

Dependency Upgrades

• Upgrade ts-jest from 29.1.2 to 29.4.1 and document breaking changes in v5 by @​dependabot[bot] in #1336
• Upgrade prettier from 2.8.8 to 3.6.2 by @​dependabot[bot] in #1334
• Upgrade actions/publish-action from 0.3.0 to 0.4.0 by @​dependabot[bot] in #1362

Full Changelog: actions/setup-node@v5...v6.0.0

Commits

• 48b55a0 Update Node.js versions in versions.yml and bump package to v6.4.0 (#1533)
• ab72c7e Upgrade @​actions dependencies (#1525)
• 53b8394 Bump minimatch from 3.1.2 to 3.1.5 (#1498)
• 54045ab Scope test lockfiles by package manager and update cache tests (#1495)
• c882bff Replace uuid with crypto.randomUUID() (#1378)
• 774c1d6 feat(node-version-file): support parsing devEngines field (#1283)
• efcb663 fix: remove hardcoded bearer (#1467)
• d02c89d Fix npm audit issues (#1491)
• 6044e13 Docs: bump actions/checkout from v5 to v6 (#1468)
• 8e49463 Fix README typo (#1226)
• Additional commits viewable in compare view

[jrphilo]

Ralphie verified this — ready to merge.

Verification

• lint: ✓
• check-types: ✓
• test: ✓ (1477 tests)
• smoke: ✓

Changelog highlights

• Breaking: automatic package-manager caching is now limited to npm; pnpm/yarn must be enabled explicitly via cache: input (#1374)
• Internal: removed hardcoded Bearer prefix on mirror-token — users of private mirrors must include the scheme themselves (#1467)
• Dep upgrades: ts-jest 29.1.2 → 29.4.1, prettier 2.8.8 → 3.6.2, actions/publish-action 0.3.0 → 0.4.0
• Release notes

Investigation

• Ownership: same maintainer (actions org, published by GitHub)
• Auth/secrets: bearer-prefix change in #1467 — investigated → doesn't affect our usage
  • Change only affects callers passing mirror-token / mirror-url to setup-node; grep across .github/ finds neither input is set in any of our workflows
• Security advisory: none referenced
• Deprecations: none we'd hit
• Breaking API: automatic-caching scope reduced in #1374 — investigated → doesn't affect our usage
  • All three setup-node steps in .github/workflows/ci.yml (lines 27, 39, 52) set cache: pnpm explicitly; the breaking change only removes auto-detection, explicit opt-in still works
  • Empirical confirmation: this PR's own CI runs (check-types, lint, test, Analyze) all passed using actions/setup-node@v6 + cache: pnpm

Recommendation

Mechanical major bump from a first-party (actions org) action. The two flagged changelog items don't touch our usage path — we explicitly opt into pnpm caching, and we don't use the private-mirror token feature. CI on the PR is the live proof that v6 + cache: pnpm works.