Fix GitHub Actions CI and package/site publishing

[rickmark]

Summary

Fixes the workflows that have been failing on main. Each fix below is matched to the error in its run logs.

Workflow	Failure	Fix
Periodic Updates	idn-ruby failed to build because libidn-dev was missing. The cron * 8 * * * ran every minute of hour 8. On a schedule inputs.ref was empty, and the $GITHUB_OUTPUT syntax was broken.	Install libidn-dev/cmake. Use the cron 17 8 * * *. Default the branch to auto-update-bot and fix the step outputs. Replace the archived repo-sync/pull-request and git-auto-commit-action with peter-evans/create-pull-request. Remove the trailing CI jobs, which only re-tested main. Give the tmp cache a rolling key.
Static Website	asn_parser failed with cmake: No such file inside the jekyll-action container	Build the site with the reusable build-jekyll.yml on the runner, then deploy the artifact to gh-pages with peaceiris/actions-gh-pages (keeps the CNAME)
Publish NPM	Caching for 'bun' is not supported; it also used GITHUB_TOKEN against npmjs.org	Drop the cache. Run npm publish on the packed tgz with --provenance, using trusted publishing (id-token: write) or secrets.NPM_TOKEN
Publish PyPI	Poetry ran at the repo root. No package-python artifact was ever uploaded. The job didn't depend on the build.	build-python.yml now uploads dist/. The publish job needs the build and only downloads and publishes, with id-token: write for trusted publishing.
Python package	build = "build.py" produced a linux_x86_64 wheel, which PyPI rejects, and the wheel had no data files	Remove the build script (CI already runs build.py). Include share/** in both the sdist and the wheel. The result is a py3-none-any wheel (about 18 MB).
Labeler	actions/labeler@v2 runs on Node 12	Move to v5 and the v5 config format

Other changes:

• The reusable workflows are now called through ./.github/workflows/... instead of hack-different/apple-knowledge/...@main, so a PR's CI runs that PR's own workflow changes.
• Actions are bumped to their Node 24 majors (checkout/cache/setup-node/upload/download v5, setup-python v6). Redundant manual bundle caches are removed; bundler-cache already covers them.

Setup needed outside the repo

• PyPI: add a trusted publisher for publish-pypi.yml, environment pypi-push.
• npm: add a trusted publisher for publish-npm.yml, environment node-push, or add an NPM_TOKEN secret.
• Update PRs: turn on Settings → Actions → Allow GitHub Actions to create and approve pull requests. PRs opened with GITHUB_TOKEN don't trigger CI on their own.

Testing

• actionlint passes on every workflow.
• Python locally: update_version.py, poetry install, build.py, pytest (3 passed) and poetry build all ran. The wheel installs into a clean venv and apple_data.get_data('apns') loads.
• Node locally: bun install, bun run build, bun run test (4 passed) and bun pm pack all ran.

🤖 Generated with Claude Code

https://claude.ai/code/session_01A7iNWzEEZrwfmb3a8J3F7L

---

Generated by Claude Code