ci: move off deprecated Node 20 actions (cibuildwheel v3.4.1, direct cargo audit)

[Xof]

Summary

GitHub forces Node 24 on Node 20 actions starting 2026-06-16. Two actions were still on Node 20:

• cibuildwheel v2.19 → v3.4.1 — its internal actions/setup-python is now v6.2.0 (Node 24). manylinux2014 is pinned so the major bump keeps the Linux wheels' glibc-2.17 floor (64-bit only, so the i686/libatomic issue doesn't apply).
• rustsec/audit-check has no Node 24 release, so the audit job now runs cargo audit directly (install + run), dropping the action and its write permissions.

peter-evans/* in bench.yml are already Node 24.

Test Plan

• workflow_dispatch run of wheels.yml on this branch validates cibuildwheel v3.4.1 + the manylinux pin across all 4 arches + sdist.
• This PR's ci.yml run exercises the new cargo audit audit job.

[github-actions]

🚦 Bench results: PR vs main

⚠️ 1 regression(s) detected across 1 scenario/mode pair(s)

Scenario	Mode	Δ throughput	Worst Δ
document-store	sqlite-strict	-2.5%	p95 +13.5% ⚠️
document-store	chisel-mem	-1.6%	—
document-store	chisel-strict	+6.9%	—
document-store	redb-strict	-1.7%	—
mutation-log	chisel-mem	-0.1%	—
mutation-log	chisel-strict	+10.9%	—
mutation-log	redb-strict	+0.1%	—
mutation-log	sqlite-strict	-0.6%	—
ycsb-a	chisel-mem	-4.5%	—
ycsb-a	chisel-strict	+11.6%	—
ycsb-a	redb-strict	-0.1%	—
ycsb-a	sqlite-strict	+2.1%	—
ycsb-b	chisel-mem	+0.1%	—
ycsb-b	chisel-strict	+4.3%	—
ycsb-b	redb-strict	-0.7%	—
ycsb-b	sqlite-strict	-1.0%	—

Per-scenario detail (4 metrics × cells)

document-store

Mode	Throughput	p50	p95	p99
chisel-mem	21167 ops/s → 20825 ops/s (-1.6%)	12.9 µs → 13.1 µs (+1.9%)	134.0 µs → 137.0 µs (+2.3%)	589.4 µs → 597.3 µs (+1.3%)
chisel-strict	2341 ops/s → 2502 ops/s (+6.9%)	21.2 µs → 21.8 µs (+2.6%)	1.49 ms → 1.32 ms (-11.6%)	2.68 ms → 2.57 ms (-3.8%)
redb-strict	4143 ops/s → 4074 ops/s (-1.7%)	18.8 µs → 19.7 µs (+5.0%)	716.0 µs → 724.1 µs (+1.1%)	1.73 ms → 1.82 ms (+4.9%)
sqlite-strict	5089 ops/s → 4962 ops/s (-2.5%)	21.2 µs → 21.4 µs (+0.8%)	597.6 µs → 678.1 µs (+13.5%) ⚠️	1.61 ms → 1.61 ms (-0.2%)

mutation-log

Mode	Throughput	p50	p95	p99
chisel-mem	45101 ops/s → 45066 ops/s (-0.1%)	23.7 µs → 23.5 µs (-1.0%)	30.4 µs → 30.2 µs (-0.5%)	40.7 µs → 40.5 µs (-0.6%)
chisel-strict	986 ops/s → 1093 ops/s (+10.9%)	1.08 ms → 1.01 ms (-6.1%)	1.90 ms → 1.71 ms (-10.1%)	3.97 ms → 3.36 ms (-15.2%)
redb-strict	1804 ops/s → 1806 ops/s (+0.1%)	245.8 µs → 244.8 µs (-0.4%)	468.1 µs → 464.4 µs (-0.8%)	23.42 ms → 23.41 ms (-0.0%)
sqlite-strict	3822 ops/s → 3798 ops/s (-0.6%)	164.2 µs → 164.7 µs (+0.3%)	538.6 µs → 534.5 µs (-0.8%)	847.4 µs → 891.9 µs (+5.3%)

ycsb-a

Mode	Throughput	p50	p95	p99
chisel-mem	31151 ops/s → 29757 ops/s (-4.5%)	39.1 µs → 41.0 µs (+4.9%)	75.2 µs → 76.3 µs (+1.4%)	87.5 µs → 88.6 µs (+1.3%)
chisel-strict	1368 ops/s → 1527 ops/s (+11.6%)	618.3 µs → 576.3 µs (-6.8%)	1.87 ms → 1.69 ms (-9.5%)	2.82 ms → 2.53 ms (-10.4%)
redb-strict	2679 ops/s → 2677 ops/s (-0.1%)	196.2 µs → 193.5 µs (-1.4%)	394.3 µs → 389.3 µs (-1.3%)	1.03 ms → 1.02 ms (-1.3%)
sqlite-strict	142702 ops/s → 145706 ops/s (+2.1%)	6.9 µs → 7.0 µs (+1.4%)	9.0 µs → 9.0 µs (-0.9%)	18.3 µs → 10.8 µs (-41.2%)

ycsb-b

Mode	Throughput	p50	p95	p99
chisel-mem	171111 ops/s → 171238 ops/s (+0.1%)	4.3 µs → 4.3 µs (+0.5%)	39.8 µs → 39.6 µs (-0.3%)	47.2 µs → 46.9 µs (-0.7%)
chisel-strict	14282 ops/s → 14897 ops/s (+4.3%)	6.4 µs → 6.4 µs (+0.6%)	602.0 µs → 569.2 µs (-5.5%)	1.54 ms → 1.47 ms (-4.2%)
redb-strict	27144 ops/s → 26962 ops/s (-0.7%)	3.1 µs → 3.0 µs (-4.2%)	194.0 µs → 192.9 µs (-0.6%)	327.1 µs → 337.7 µs (+3.2%)
sqlite-strict	180456 ops/s → 178651 ops/s (-1.0%)	5.5 µs → 5.6 µs (+1.3%)	7.6 µs → 7.6 µs (-0.1%)	10.0 µs → 9.8 µs (-1.3%)

_{Generated by chisel-bench-diff at 2026-06-08T03:01:27Z. Compares PR HEAD against main. Never blocks merge — signal, not gate. Thresholds: throughput 5%, p50 5%, p95 10%, p99 10%.}