ci: pin the noble-dependent runners, and attest the SBOM without the wrapper

[DeusData]

Distilled from #2109 by @rarepops, carried with Co-authored-by. #2109 stays open — this takes two slices, not the PR.

1. Three runners pinned to ubuntu-24.04

_lint.yml lint and lint-mem, and _test.yml test-diag, each install a toolchain from an apt repo that names the release:

deb http://apt.llvm.org/noble/ llvm-toolchain-noble-20 main
deb http://apt.llvm.org/noble/ llvm-toolchain-noble-21 main

noble is 24.04. These jobs already depend on a specific release while asking for whatever ubuntu-latest means that morning. When GitHub advances ubuntu-latest, all three break at once on a day nobody chose, and it surfaces as an apt error far from its cause.

2. actions/attest-sbom → actions/attest

attest-sbom is deprecated; what it does now is print a deprecation warning and forward to actions/attest with NODE_OPTIONS set, passing sbom-path through unchanged.

Verified rather than assumed, because this is on the release path:

• 59d89421af93a897026c735860bf21b6eb4f7b26 is exactly tag v4.1.0 of actions/attest (checked via the git ref API)
• sbom-path is a real input on that action at that SHA (checked against its action.yml)

The step keeps no continue-on-error, so a failed SBOM attestation still fails the release — and the comment now says so explicitly. An unattested SBOM is worse than an absent one, because the artifact ships looking complete.

Deliberately not taken from #2109

slice	why not
actionlint job in _lint.yml	_lint.yml is consumed by pr.yml, dry-run.yml and release.yml; pr.yml gates its whole test stage on lint succeeding and release.yml:105 gates build on needs.lint.result == 'success'. A job there is merge- and release-blocking with no branch-protection edit to make it visible — and this one curls a tarball from github.com releases with no cache or fallback. Worth having, not on that path, and not before it has been run against current main.
test-package-wrappers node matrix	Reruns the Go and PyPI suites a second time per OS to vary a Node version only the npm leg reads.
test-frontend, .node-version, dependabot graph-ui	The UI is being rebuilt from the ground up; gating on the current one buys coverage of a surface that is going away. .node-version would also desync the Windows VM, which pins v22.23.1 in provision-windows.sh:96.

Note

main currently carries one unrelated failing test (fix in #2248), so expect that red here until it lands. PyYAML is not installed locally so I could not lint the YAML offline — this PR's own CI consumes both edited reusable workflows, so a syntax error fails immediately.