refactor(ci): build once per platform, reuse artifacts in release

- Merge build-prebuilds.yml logic into ci.yml
- Build native addon once per platform (Node 22), test across Node 20/24
- Release workflow downloads CI artifacts instead of rebuilding
- Pin third-party actions to commit SHAs for supply chain security
- Extend artifact retention to 14 days for release flexibility

Efficiency gains:
- 6 fewer native builds per PR (~60 min saved)
- 3 fewer builds per release (~30 min saved)
- Simpler workflow graph (3 files instead of 4)

Author: pproenca