#19: silence the CI annotations and stop cancelling a run on every merge

Concurrency. release.yml calls ci.yml, so a push to main started the
called workflow and the standalone one, both landing in the concurrency
group ci-<ref>. One cancelled the other and every merge left a cancelled
run behind. main is now excluded from the push trigger: release.yml is
already the entry point there, and pull_request still covers changes
before they land.

Node 20 deprecation (23 warnings). Every action was pinned to a major
that still declares node20. Each replacement was checked by reading the
action.yml at the new tag and confirming "using: node24", and the inputs
in use were confirmed to still exist there:

  checkout v4->v7, setup-node v4->v7, setup-go v5->v7,
  upload-artifact v4->v7, download-artifact v4->v7,
  setup-buildx-action v3->v4, build-push-action v6->v7,
  login-action v3->v4, metadata-action v5->v6

download-artifact has a v8, but v7 is also node24 and matches the upload
side, so the pair stays on one major. trivy-action is a composite action
and has no Node runtime to deprecate.

Go cache (1 warning). setup-go looked for go.sum at the repository root
and skipped its cache: defaults.run.working-directory applies to run
steps, not to actions. cache-dependency-path now points at
services/protocols/go.sum.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.github/workflows/release.yml

@@ -60,12 +60,12 @@ jobs:
             runner: ubuntu-24.04-arm
             arch: arm64
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
-      - uses: docker/setup-buildx-action@v3
+      - uses: docker/setup-buildx-action@v4
 
       - name: Autentica no GHCR
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
@@ -73,7 +73,7 @@ jobs:
 
       - name: Metadados
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         with:
           images: ${{ env.REGISTRY }}/${{ needs.prepare.outputs.namespace }}/${{ matrix.service }}
 
@@ -81,7 +81,7 @@ jobs:
       # architectures exist and can be joined into a single manifest list.
       - name: Build e push por digest
         id: build
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           context: services/${{ matrix.service }}
           platforms: ${{ matrix.platform }}
@@ -99,7 +99,7 @@ jobs:
           touch "/tmp/digests/${digest#sha256:}"
 
       - name: Guarda o digest
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           # Slashes are not allowed in artifact names, hence the arch alias.
           name: digest-${{ matrix.service }}-${{ matrix.arch }}
@@ -119,19 +119,19 @@ jobs:
       matrix:
         service: [protocols, auth, storage, webmail]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
-      - uses: docker/setup-buildx-action@v3
+      - uses: docker/setup-buildx-action@v4
 
       - name: Autentica no GHCR
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Recupera os digests
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v7
         with:
           pattern: digest-${{ matrix.service }}-*
           merge-multiple: true
@@ -142,7 +142,7 @@ jobs:
       # release; the sha tag does the same for any main build.
       - name: Metadados
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         with:
           images: ${{ env.REGISTRY }}/${{ needs.prepare.outputs.namespace }}/${{ matrix.service }}
           tags: |