CI follow-ups: undocumented tooling in CHANGELOG, deprecated action runtime #4

Two follow-ups from the verification tooling that merged with #3.

1. The CHANGELOG does not mention the tooling that shipped

main carries .github/workflows/verify.yml, scripts/contrast-check.js, scripts/render-check.js, package.json / package-lock.json and .github/PULL_REQUEST_TEMPLATE.md, but CHANGELOG.md documents none of them — it stops at the page fixes.

Cause: the commit that added those files staged them individually and left CHANGELOG.md out of the git add, so the entries never left the working tree. CONTRIBUTING.md requires documentation and changelog files to be updated alongside a change, so this is a gap against that rule rather than a cosmetic one.

2. The workflow's actions target the deprecated Node 20 runtime

The first verify run annotated:

Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/cache@v4, actions/checkout@v4, actions/setup-node@v4, actions/upload-artifact@v4

They still execute, but the warning will appear on every future run. Current majors are checkout v7, setup-node v7, cache v6, upload-artifact v7; the workflow only uses inputs that are stable across those bumps (node-version, cache, path, key, name, if-no-files-found, retention-days).

Scope

One PR: add the missing CHANGELOG entries, bump the four actions. No change to the page itself, so verify going green is the whole acceptance signal.