ci: remove node20 workflow action warnings

[xiaojiou176]

Summary

• replace the pull-request dependency review action with a repo-owned REST-backed dependency review gate driven by the existing .github/dependency-review-config.yml policy
• bump pinned actions/checkout, actions/upload-artifact, and actions/download-artifact workflow SHAs onto their Node 24-based major lines across active workflows and governance tests
• remove the retired dependency-review-action supply-chain inventory references and sync the root/docs/changelog wording to the new repo-owned CI contract

Verification

• python3 -m pytest -q apps/orchestrator/tests/test_dependency_review_gate.py apps/orchestrator/tests/test_workflow_runner_governance.py apps/orchestrator/tests/test_ci_governance_policy_extended.py
• bash scripts/check_workflow_static_security.sh
• python3 scripts/check_dependency_review_gate.py --config-file .github/dependency-review-config.yml --repo xiaojiou176-open/OpenVibeCoding --base-sha 25bd400 --head-sha 15f1608
• PYTHONDONTWRITEBYTECODE=1 npm run docs:check
• PYTHONDONTWRITEBYTECODE=1 bash scripts/check_repo_hygiene.sh
• PYTHONDONTWRITEBYTECODE=1 npm run truth:triage