Modernize CI: macos-26 runner, drop pinned Xcode path, bump action pins

- runs-on: macos-13 → macos-26 (current Apple Silicon runner image)
- Drop --xcode-path arg from build invocation; script defaults to
  xcode-select -p, which on macos-26 resolves to the runner's
  default Xcode (no longer Xcode 15.2)
- actions/checkout v3.4.0 → v4.1.7
- apple-actions/import-codesign-certs v2.0.0 → v3.0.0
- actions/upload-artifact v4.6.2 → v4.3.4 (matches Nudge for
  cross-tool consistency)
- metcalfc/changelog-generator and softprops/action-gh-release
  already matched Nudge; left untouched

Pins mirror macadmins/nudge's Manual build workflow for consistency
across the maintainer's macOS toolchain.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.github/workflows/build_python_3.14.yml

@@ -14,23 +14,23 @@ on:
 
 jobs:
   build:
-    runs-on: macos-14
+    runs-on: macos-26
 
     steps:
     - name: Checkout python repo
-      uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f # v3.4.0
+      uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
       with:
         fetch-depth: 0
 
     - name: Install Apple Developer ID Application certificates
-      uses: apple-actions/import-codesign-certs@8f3fb608891dd2244cdab3d69cd68c0d37a7fe93 # v2.0.0
+      uses: apple-actions/import-codesign-certs@63fff01cd422d4b7b855d40ca1e9d34d2de9427d # v3.0.0
       with:
         keychain-password: ${{ github.run_id }}
         p12-file-base64: ${{ secrets.APP_CERTIFICATES_P12_MAOS }}
         p12-password: ${{ secrets.APP_CERTIFICATES_P12_PASSWORD_MAOS }}
 
     - name: Install Apple Developer ID Installer certificates
-      uses: apple-actions/import-codesign-certs@8f3fb608891dd2244cdab3d69cd68c0d37a7fe93 # v2.0.0
+      uses: apple-actions/import-codesign-certs@63fff01cd422d4b7b855d40ca1e9d34d2de9427d # v3.0.0
       with:
         create-keychain: false # do not create a new keychain for this value
         keychain-password: ${{ github.run_id }}
@@ -38,7 +38,12 @@ jobs:
         p12-password: ${{ secrets.PKG_CERTIFICATES_P12_PASSWORD_MAOS }}
 
     - name: Run build package script
-      run: ./build_python_framework_pkgs.zsh "$TYPE" "$DEV_INSTALLER_ID" "$DEV_APPLICATION_ID" "$PYTHON_VERSION" "$PYTHON_MAJOR_VERSION" "${NOTARY_APP_PASSWORD}"
+      run: |
+        ./build_python_framework_pkgs.zsh \
+          --python-version "$PYTHON_VERSION" \
+          --installer-id "$DEV_INSTALLER_ID" \
+          --application-id "$DEV_APPLICATION_ID" \
+          --notary-password "$NOTARY_APP_PASSWORD"
 
     - name: get environment variables
       id: get_env_var
@@ -85,7 +90,7 @@ jobs:
         files: ${{github.workspace}}/outputs/*.pkg
 
     - name: Upload packages
-      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+      uses: actions/upload-artifact@0b2256b8c012f0828dc542b3febcab082c67f72b # v4.3.4
       with:
         name: packages
         path: outputs/