Use actions/checkout@v7 and actions/setup-python@v7, which run on Node.js 24.
Invoke the official Comfy CLI directly because the upstream publishing
composite still embeds older setup actions.
Preserve the existing publish triggers, Python version, registry secret,
package version and read-only repository permissions. Pass the registry
token through a quoted environment variable.
Validation: actionlint and shell syntax checks pass; publish triggers and
secret references match the previous workflow. No registry publication is
triggered by this workflow-only change.
Boobkake22