ci: upload-artifact v3 — v4+ is refused by the forge

This workflow runs on git.hanzo.ai, which presents as GHES, and the v4 action
refuses before doing any work:

    GHESNotSupportedError: @actions/artifact v2.0.0+, upload-artifact@v4+ and
    download-artifact@v4+ are not currently supported on GHES.

v4 moved to an artifact API the forge does not implement, so this is a hard
refusal rather than a transient upload error — retrying could never help. The
damaging part is how it presents: the build step passes, the artifact step
fails, and the job reports "failed", so a green build reads as a broken one and
the artifact is silently never produced.

Found on hanzoai/chains, where every VM in a 15-way matrix compiled and then
discarded its binary at this step. Swept the estate for the same pattern.

Co-authored-by: Hanzo Dev <[email protected]>

.hanzo/workflows/release.yml

@@ -95,7 +95,12 @@ jobs:
           (cd dist && shasum -a 256 "kms-${GOOS}-${GOARCH}" "kmsd-${GOOS}-${GOARCH}" \
             > "kms-${GOOS}-${GOARCH}.sha256")
 
-      - uses: actions/upload-artifact@v4
+      # v3, not v4+: this workflow runs on git.hanzo.ai, which presents as GHES.
+      # The v4 action refuses outright — "GHESNotSupportedError: @actions/artifact
+      # v2.0.0+ ... not currently supported on GHES" — so the job builds its
+      # artifact and then discards it at the last step, and reads as a build
+      # failure when the build actually succeeded.
+      - uses: actions/upload-artifact@v3
         with:
           name: binaries-${{ matrix.goos }}-${{ matrix.goarch }}
           path: dist/*
@@ -112,7 +117,12 @@ jobs:
           ref: ${{ inputs.tag || github.ref }}
           fetch-depth: 0
 
-      - uses: actions/download-artifact@v4
+      # v3, not v4+: this workflow runs on git.hanzo.ai, which presents as GHES.
+      # The v4 action refuses outright — "GHESNotSupportedError: @actions/artifact
+      # v2.0.0+ ... not currently supported on GHES" — so the job builds its
+      # artifact and then discards it at the last step, and reads as a build
+      # failure when the build actually succeeded.
+      - uses: actions/download-artifact@v3
         with:
           path: dist
           merge-multiple: true