Bump GitHub Actions: checkout v4→v6, setup-python v5→v6

## Description
Several GitHub Actions dependencies have newer major versions available. Bumping avoids Node.js 20 deprecation (June 2026) and picks up improvements.

## Changes needed
- `actions/checkout` v4 → v6
- `actions/setup-python` v5 → v6

## Acceptance criteria
- [ ] All action versions bumped
- [ ] CI passes after bump