refactor(ci): consolidate and optimize native build workflows

Merged duplicate workflows and significantly improved the native build pipeline:

Consolidation & DRY:
- Merged build-native.yml and build-native-scanner.yml into single workflow
- Removed unused scripts: bin/build-native, bin/hash, bin/hash.js

Release Management:
- Centralized all release uploads in finalize-release job
- Replaced svenstaro/upload-release-action with native gh CLI
- Removed manual checksum generation (GitHub provides manifests)

Security & Best Practices:
- Added explicit least-privilege permissions (contents: read by default)
- Only finalize-release has contents: write permission
- Replaced custom PAT with built-in GITHUB_TOKEN
- Added concurrency control to cancel outdated PR builds
- Added timeouts to all jobs (5-60 min based on complexity)
- Use ubuntu-slim for bookkeeping jobs

Dependencies & Fixes:
- Updated all GitHub Actions to latest versions:
  • checkout: v3 → v6
  • cache: v3 → v5
  • setup-node: v4 → v6
  • upload-artifact: v4 → v6
  • download-artifact: v4 → v7
- Fixed deprecated set-output command in setup-node action
- Fixed missing Node.js setup in finalize-release job
- Actually use x64 macos runner to build for x64
- Made code signing optional for non-tag builds

Author: dividedmind

.github/actions/setup-node/action.yml

@@ -4,20 +4,20 @@ runs:
   using: 'composite'
   steps:
     - name: Setup Node
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@v6
       with:
         node-version: 18
     - name: Detect Yarn cache dir
       id: yarn-cache-dir-path
       shell: bash
-      run: echo "::set-output name=dir::$(yarn config get cacheFolder)"
+      run: echo "dir=$(yarn config get cacheFolder)" >> $GITHUB_OUTPUT
     - name: Restore Yarn packages
-      uses: actions/cache/restore@v3
+      uses: actions/cache/restore@v5
       with:
         path: ${{ steps.yarn-cache-dir-path.outputs.dir }}
         key: ${{ github.job }}-yarn-${{ hashFiles('yarn.lock') }}
     - name: Restore node_modules
-      uses: actions/cache@v3
+      uses: actions/cache@v5
       with:
         path: ./node_modules
         key: ${{ github.job }}-node-modules-${{ hashFiles('yarn.lock') }}