ci: pin runners to ubuntu-24.04

[arbianst]

What

ubuntu-latest migrates to Ubuntu 26 on 2026-10-19 (actions/runner-images#14748), which is why every job in this repo has been printing that notice. Pinning means the runner image changes when we change it, not on GitHub's calendar.

workflow	jobs pinned
documentation-freshness.yml	1
validate.yml	1

2 jobs in total, ubuntu-latest → ubuntu-24.04. No ubuntu-latest is left in .github/workflows/.

Risk

None today. ubuntu-latest already resolves to ubuntu-24.04, so this is byte-identical behaviour now and a deliberate decision in October.

Merging runs validate.

Verification

actionlint 1.7.12 — the pin sent-dm-github-actions CI uses — produces exactly the same findings on this branch as on main, so nothing was introduced.

Context

Org-wide sweep after the same notice showed up on the infra Tofu pipeline: sentdm/sent-dm-github-actions#34, sentdm/sent-dm-infra#375 and #377 fixed it there, along with two Node 20 actions.

🤖 Generated with Claude Code

[claude]

Looks good, straightforward config change.

What was reviewed: both hunks confirmed to be exactly runs-on: ubuntu-latest to runs-on: ubuntu-24.04 in documentation-freshness.yml and validate.yml, no other lines touched. No ubuntu-latest references remain in .github/workflows/. This is a behavior-neutral pin (current ubuntu-latest already resolves to 24.04) with no logic, permissions, or secrets changes.

Extended reasoning...

Overview

The PR touches exactly two GitHub Actions workflow files, changing runs-on: ubuntu-latest to runs-on: ubuntu-24.04 in one job each (freshness-and-routing and validate). I ran the diff command directly and confirmed it contains only these two single-line changes with no other modifications to permissions, secrets, steps, or triggers.

Security risks

None. Pinning a runner OS version is a purely operational change that does not affect permissions, secrets handling, or code execution logic. It does not introduce injection, auth bypass, or data exposure risks.

Level of scrutiny

This warrants light scrutiny. It is a minimal, mechanical, well-understood CI maintenance change (pinning a floating alias to its current resolved version) with no functional behavior change today, consistent with the stated rationale of avoiding an unplanned OS migration in October.

Other factors

No CLAUDE.md conventions apply, no CODEOWNERS concerns were noted, and the change is self-contained and easily reversible if ubuntu-24.04 runners become unavailable. No prior review comments exist on this PR to address, and the bug-hunting system reported no findings.