GitHub's deprecation annotation on the 0.2.3 run flagged the prior
v4/v4/v2 actions for using Node 20, which is removed from the runner
in September 2026. Move to actions/checkout@v6, actions/setup-node@v6,
and actions/attest-build-provenance@v4 — all on the node24 runtime.
- New workflow signs main.js / manifest.json / styles.css with GitHub
artifact attestation on every tag push, then creates or updates the
matching release. Going forward, pushing a 'X.Y.Z' tag is enough to
ship a verified release.
- Expand all '#fff' shorthand to '#ffffff' for hex-format consistency
flagged by the community directory scanner.
