ci(release): use setup-node@v6 tag — the pinned SHA was an orphaned tag-object SHA (#13)

Pinning to the v6 major tag's commit SHA is fragile: v6 is a moving
lightweight tag, and a new v6.x release orphaned/GC'd the commit the SHA
pointed to → GitHub Actions couldn't resolve it ("unable to find version
48b55a0…", 422 on direct commit lookup). Use the moving @v6 tag directly
(matches oven-sh/setup-bun@v2 precedent in .github/actions/setup);
dependabot keeps it current. Trusted-publishing behavior unchanged.

Author: SutuSebastian

.github/workflows/release.yml

@@ -34,7 +34,7 @@ jobs:
       # npm 10.x in PATH → `npm publish` can't detect OIDC → ENEEDAUTH.
       # Node 24 ships npm 11.x; npm then auto-authenticates via OIDC (no token).
       - name: Setup Node + npm for trusted publishing
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9f7362e8dae4041e # v6
+        uses: actions/setup-node@v6
         with:
           node-version: "24"
           registry-url: "https://registry.npmjs.org"