Fix downgrade_release CI: update checkout action and add token fallback

[Copilot]

The downgrade_release job was failing at checkout because secrets.WORKFLOWS_TOKEN is not configured — GitHub Actions passes an empty string for undefined secrets, causing git authentication to fail entirely.

Changes

• actions/checkout@v3 → actions/checkout@v4 — v3 runs on deprecated Node.js 20 (forced off Sept 2026)
• Token fallback — ${{ secrets.WORKFLOWS_TOKEN || github.token }} ensures the always-available github.token is used when WORKFLOWS_TOKEN is unset, fixing both the initial clone and the git push at the end of the job (credentials are persisted by the checkout action)

# before
-   uses: "actions/checkout@v3"
    with:
        token: ${{ secrets.WORKFLOWS_TOKEN }}

# after
-   uses: "actions/checkout@v4"
    with:
        token: ${{ secrets.WORKFLOWS_TOKEN || github.token }}