chore(deps): update actions/download-artifact action to v5 (#644)

This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
|
[actions/download-artifact](https://redirect.github.com/actions/download-artifact)
| action | major | `v4.3.0` -> `v5.0.0` |

---

### Release Notes

<details>
<summary>actions/download-artifact (actions/download-artifact)</summary>

###
[`v5.0.0`](https://redirect.github.com/actions/download-artifact/releases/tag/v5.0.0)

[Compare
Source](https://redirect.github.com/actions/download-artifact/compare/v4.3.0...v5.0.0)

##### What's Changed

- Update README.md by
[@&#8203;nebuk89](https://redirect.github.com/nebuk89) in
[https://github.com/actions/download-artifact/pull/407](https://redirect.github.com/actions/download-artifact/pull/407)
- BREAKING fix: inconsistent path behavior for single artifact downloads
by ID by [@&#8203;GrantBirki](https://redirect.github.com/GrantBirki) in
[https://github.com/actions/download-artifact/pull/416](https://redirect.github.com/actions/download-artifact/pull/416)

##### v5.0.0

##### 🚨 Breaking Change

This release fixes an inconsistency in path behavior for single artifact
downloads by ID. **If you're downloading single artifacts by ID, the
output path may change.**

##### What Changed

Previously, **single artifact downloads** behaved differently depending
on how you specified the artifact:

- **By name**: `name: my-artifact` → extracted to `path/` (direct)
- **By ID**: `artifact-ids: 12345` → extracted to `path/my-artifact/`
(nested)

Now both methods are consistent:

- **By name**: `name: my-artifact` → extracted to `path/` (unchanged)
- **By ID**: `artifact-ids: 12345` → extracted to `path/` (fixed - now
direct)

##### Migration Guide

##### ✅ No Action Needed If:

- You download artifacts by **name**
- You download **multiple** artifacts by ID
- You already use `merge-multiple: true` as a workaround

##### ⚠️ Action Required If:

You download **single artifacts by ID** and your workflows expect the
nested directory structure.

**Before v5 (nested structure):**

```yaml
- uses: actions/download-artifact@v4
  with:
    artifact-ids: 12345
    path: dist

##### Files were in: dist/my-artifact/
```

> Where `my-artifact` is the name of the artifact you previously
uploaded

**To maintain old behavior (if needed):**

```yaml
- uses: actions/download-artifact@v5
  with:
    artifact-ids: 12345
    path: dist/my-artifact  # Explicitly specify the nested path
```

##### New Contributors

- [@&#8203;nebuk89](https://redirect.github.com/nebuk89) made their
first contribution in
[https://github.com/actions/download-artifact/pull/407](https://redirect.github.com/actions/download-artifact/pull/407)

**Full Changelog**:
actions/download-artifact@v4...v5.0.0

</details>

---

### Configuration

📅 **Schedule**: Branch creation - "before 9am on monday" in timezone
Asia/Shanghai, Automerge - At any time (no schedule defined).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/oxc-project/oxc-resolver).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MS42MC40IiwidXBkYXRlZEluVmVyIjoiNDEuNjAuNCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

Author: renovate[bot]

.github/workflows/codecov.yml

@@ -62,7 +62,7 @@ jobs:
 
       - name: Download coverage file
         if: env.CODECOV_TOKEN
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
         with:
           name: codecov
 

.github/workflows/release-napi.yml

@@ -211,7 +211,7 @@ jobs:
         run: pnpm install --frozen-lockfile
 
       - name: Download Artifacts
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
         with:
           path: artifacts