fix(ci): repin actions/setup-node to verified v4.0.2 SHA (#1432)

The setup-node pin in .gitea/workflows/e2e-chat.yml was a typo'd
SHA (60edb5dd...af0d6f5) that 404s in the self-hosted action
mirror (DEFAULT_ACTIONS_URL=self → git.moleculesai.app/actions/
setup-node). It is a 1-char corruption of the real v4.0.2 SHA
(...af0d1f8). Introduced in 843092db (2026-05-14), it has broken
E2E Chat / E2E Chat on base staging for ~3 days.

Repinned to the mirror-verified v4.0.2 commit
60edb5dd545a775178f52524783378180af0d1f8 (the exact SHA the
v4.0.2 tag resolves to in actions/setup-node on git.moleculesai.app;
GET on the commit returns 200; corrupted SHA GET returns 404).
Comment tightened # v4 → # v4.0.2 to document the exact pinned ref.

Scope: single line, this one corrupted SHA only. No other action
pins, workflows, or lines touched.

Refs: molecule-core #1432

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.gitea/workflows/e2e-chat.yml

@@ -97,7 +97,7 @@ jobs:
           cache-dependency-path: workspace-server/go.sum
 
       - if: needs.detect-changes.outputs.chat == 'true'
-        uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d6f5 # v4
+        uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2
         with:
           node-version: '22'
           cache: 'npm'