ci: bump checkout to v6 (Node 24), note dismissed torch alert

actions/checkout@v4 ran on the deprecated Node 20; bump to v6 to match
test.yml/publish.yml. Document the dismissed Dependabot torch alert
(GHSA-rrmf-rvhw-rf47, not_used: no torch.jit usage, gpu-extra-only, no patch).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.github/workflows/distribute.yml

@@ -67,7 +67,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout the tap
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           repository: wiltodelta/homebrew-tap
           token: ${{ secrets.HOMEBREW_TAP_TOKEN }}