Bump actions/checkout to v5

[guohai]

CI annotates every run with "Node.js 20 is deprecated" for actions/checkout@v4.
codex-code-review.yml was already on v5; this brings ci.yml,
claude-code-review.yml and release.yml in line.

Also corrects the BashBare test label, which still read bash --norc after that
variant moved to --noprofile --rcfile.

Opened partly to exercise the two code-review workflows now that their keys are
configured.

Generated with SMT smt@agora.build

[github-actions]

🤖 Codex Code Review

No issues found. The checkout upgrades are consistent across the workflows, and GitHub-hosted runners support the Node.js 24 runtime used by actions/checkout@v5. The BashBare label now accurately distinguishes the variant that skips the user’s normal startup files while still loading the test harness via --rcfile.

No scrollback arithmetic, shell-hook behavior, or captured terminal-content handling is changed by this PR.

[github-actions]

🤖 Claude Code Review

No issues found. This is a CI-only change plus one test-label fix; no Rust source, no src/backend/tmux.rs coordinate arithmetic, and no shell/ hook code is touched, so the scrollback and $?/argv invariants are unaffected.

What I checked

• actions/checkout@v4 → v5 (6 call sites) — the repo is now consistent: codex-code-review.yml was already on v5, so this removes the mixed state rather than creating one. v5's breaking change is the Node 24 runtime (requires runner ≥ 2.327.0); every job here runs on GitHub-hosted ubuntu-latest or macos-14, which satisfy that. No self-hosted runners in the matrix.
• No behavioral dependency on v4 defaults. claude-code-review.yml keeps its explicit ref: refs/pull/N/merge + fetch-depth: 0; the other sites use defaults, and v5 does not change fetch-depth, ref resolution, or credential-persistence defaults. The verify gate on release.yml still runs ahead of the publishing jobs, so the release ordering is intact.
• tests/tmux_e2e.rs:121 — the old label "bash --norc" named a flag the harness deliberately does not pass (line 143 uses --noprofile --rcfile, with a comment explaining that --norc would override --rcfile). The new "bash (no rc)" is accurate for what the variant actually does — a bare rc containing only the tcap setup, skipping the developer's ~/.bashrc — and matches the bash-preexec-vs-own-trap distinction the two variants exist to cover. Label is diagnostic-only (assertion messages at lines 269 and 552), so no test semantics change.
• Leak surface — nothing in the diff moves captured terminal text into logs, artifacts, or workflow outputs.

One non-blocking note

actions/checkout is pinned by floating major tag while codex-code-review.yml pins openai/codex-action to a v1.11 SHA. That asymmetry is defensible — checkout is first-party GitHub and the SHA pin there was a hang-avoidance fix, not a supply-chain policy — but if SHA pinning is the intended convention for workflows that hold NPM_TOKEN/CF_API_TOKEN, release.yml is the place it would matter most. Out of scope for this PR either way.