chore(ci): clear Node 20 deprecation warnings across shared workflows

[pdodgen-revparts]

Summary

GitHub is forcing Node 20 actions to run on Node 24 and logs a warning on every workflow run:

```
##[warning]Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: ...
```

This PR bumps the actions that have Node 24 native versions and wires `token:` on `azure/setup-helm` / `Azure/setup-kubectl` to also eliminate the noisy `GITHUB_TOKEN not set` warning from every rt-* auto-deploy log.

Bumps

Action	From	To	Files
`aws-actions/configure-aws-credentials`	v4	v5	helm-deploy-eks.yaml
`azure/setup-helm`	v3	v4	helm-deploy-eks.yaml, helm-deploy.yaml, helm-deployv2.yaml, helm-rollback.yaml
`Azure/setup-kubectl`	v3	v4	same 4 files
`actions/setup-node`	v4	v5	openapi-generate-{javascript,typescript}-client.yaml
`mathieudutour/github-tag-action`	v6.1	v6.2	build-php-v1.yaml, build-php-laravel.yaml

Token wiring

Add `token: ${{ github.token }}` to every `azure/setup-helm` and `Azure/setup-kubectl` invocation. Without it, both actions try to fetch the latest tool version via GitHub API, fail auth, and log a `::warning::[@octokit/auth-action] GITHUB_TOKEN not set` message. Deploys succeed with a hard-coded fallback version — cosmetic, but eliminates the noise.

Deferred to follow-up

• `actions/upload-artifact` v4 → v5 has a breaking change (duplicate artifact names now error instead of warn). Used in 5 workflows — needs per-usage review before bumping.
• `docker/setup-buildx-action@v3`, `docker/login-action@v3`, `docker/build-push-action@v6` have no Node 24 upstream release yet. Wait for upstream.

Spotted (not fixed here — worth a separate ticket)

• `helm-rollback.yaml:31` references `${{ inputs.image_tag }}` in the checkout ref, but the workflow's inputs are `{deployment, environment, namespace}`. Pre-existing typo — falls through to the default ref silently. Actionlint flagged this while I was in the file.

Verification

• `actionlint` clean on all 8 modified files (only pre-existing shellcheck-info noise + the helm-rollback typo above)
• Every existing `with:` block extended, never replaced
• No downstream breaking-change semantics on any of the bumped majors that I could find (v5s are backwards-compatible for our usage)

Blast radius

Every RT v2 participant that runs helm-* deploys OR build-php-* orchestrators inherits these versions on next call. That's ~22 repos. Downstream failure would be visible immediately on the next deploy run.

Related

• DEVEX-1653 (RT v2 downstream — auto-deploy noise reduction)
• DEVEX-1680 (batch Shape 1 — where the setup-helm warning was first spotted)

[cursor]

PR Summary

Medium Risk
Changes affect shared workflow_call deploy and PHP build paths used by many downstream repos; failures would show on the next inherited run, though bumps are intended to be backward-compatible for current usage.

Overview
Updates reusable GitHub Actions workflows so CI stops emitting Node 20 deprecation noise and trims recurring warnings on Helm/Kubectl setup.

Action version bumps: mathieudutour/github-tag-action v6.1 → v6.2 in PHP Laravel/v1 build orchestrators (dry-run and release tagging). aws-actions/configure-aws-credentials v4 → v5 on EKS Helm deploy. azure/setup-helm and Azure/setup-kubectl v3 → v4 across all Helm deploy/rollback workflows. actions/setup-node v4 → v5 in both OpenAPI client generation workflows.

New token wiring: Every azure/setup-helm and Azure/setup-kubectl step now passes token: ${{ github.token }} so those actions can resolve the latest tool release via the GitHub API instead of logging GITHUB_TOKEN not set and falling back to a default version. EKS Helm setup documents this in a short comment; helm-deploy.yaml keeps its existing helm_version input alongside the new token.

No application or deploy script logic changes—only third-party action pins and optional auth for tool version resolution.

^{Reviewed by Cursor Bugbot for commit 45a4499. Bugbot is set up for automated code reviews on this repo. Configure here.}