ci: bump setup-python v5 -> v6 in setup-backend to run on Node 24

GitHub forces Actions off Node 20 starting June 16, 2026. The shared
setup-backend composite action still pins actions/setup-python@v5 (Node 20),
which surfaces a deprecation warning on every backend job. Bump to v6 (Node 24),
reusing the same pinned SHA already used in bump-python-package.yml.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.github/actions/setup-backend/action.yml

@@ -42,7 +42,7 @@ runs:
         fi
         echo "python-version=$RESOLVED_VERSION" >> "$GITHUB_OUTPUT"
     - name: Set up Python ${{ steps.set-python-version.outputs.python-version }}
-      uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+      uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
       with:
         python-version: ${{ steps.set-python-version.outputs.python-version }}
         cache: ${{ inputs.cache }}

docs/netlify.toml

@@ -28,19 +28,14 @@
   # Skip builds when no docs changes (exit 0 = skip, non-zero = build).
   # Checks for changes in docs/ and README.md (which gets pulled into docs).
   #
-  # $CACHED_COMMIT_REF is the last *deployed* commit; it is set on incremental
-  # builds (notably the master production deploy) and empty on a context's
-  # first build (every deploy preview). The production path diffs against it
-  # and skips correctly.
-  #
-  # Deploy previews need different handling: Netlify checks out a *merge*
-  # commit, so $COMMIT_REF (the PR head SHA) is frequently not resolvable in
-  # the clone, and on a shallow clone `git merge-base` can fail too -- so the
-  # previous logic fell through to a build on every PR, even non-docs ones.
-  # Instead, always diff the checked-out HEAD against its merge-base with
-  # master, deepening the shallow clone until that merge-base resolves. If it
-  # genuinely can't be determined, exit non-zero to build (fail safe).
-  ignore = 'if [ -n "$CACHED_COMMIT_REF" ]; then git diff --quiet "$CACHED_COMMIT_REF" HEAD -- . ../README.md; else git fetch --no-tags origin master >/dev/null 2>&1 || true; i=0; while [ "$i" -lt 10 ] && ! git merge-base origin/master HEAD >/dev/null 2>&1; do git fetch --deepen=200 origin master >/dev/null 2>&1 || break; i=$((i+1)); done; BASE="$(git merge-base origin/master HEAD 2>/dev/null || true)"; if [ -z "$BASE" ]; then exit 1; fi; git diff --quiet "$BASE" HEAD -- . ../README.md; fi'
+  # $CACHED_COMMIT_REF is the last *deployed* commit. On a PR's first build it
+  # is empty, so the original `git diff` errored and Netlify fell back to
+  # building -- which is why every PR built a docs preview once even with no
+  # docs changes. When it is empty we instead diff the whole branch against its
+  # merge-base with master, so non-docs PRs are skipped from the very first
+  # build. Subsequent builds (and the master production build) keep the cheaper
+  # incremental $CACHED_COMMIT_REF diff. Any failure exits non-zero -> build.
+  ignore = 'if [ -n "$CACHED_COMMIT_REF" ]; then git diff --quiet "$CACHED_COMMIT_REF" "$COMMIT_REF" -- . ../README.md; else git fetch origin master --depth=100 >/dev/null 2>&1; git diff --quiet "$(git merge-base origin/master "$COMMIT_REF" 2>/dev/null || echo origin/master)" "$COMMIT_REF" -- . ../README.md; fi'
 
 [build.environment]
   # Node version matching docs/.nvmrc