v4.20.7

Patch release on top of v4.20.6. Contains a security update, two bug fixes, and a CI change.

Full changelog: v4.20.6...v4.20.7

🔒 Security

- Bump Redis to 8.10.2 for CVE-2026-85091. Updates the pinned Redis version across all Docker images (build + server) and the sanitizer/test paths. (#2850, fixes #2849)

🐛 Bug Fixes

- Prevent crash from concurrent GRAPH.CONSTRAINT creation. A write query reserves node IDs under the read lock, then releases it to commit under the write lock; in that gap a failing async GRAPH.CONSTRAINT could roll back and zero the graph-global reserved_node_count, driving it negative on the write query's commit — an assert in debug and datablock corruption (later crash) in release. A read-locked pre-check now rejects the common benign failures (constraint already exists, missing supporting index, duplicate properties) without taking the write lock or rolling back. (#2875, fixes #2880; partially mitigates the underflow crash tracked in #238 — a TOCTOU residual remains)
- Seek-by-id now optimizes compound expressions opposite ID(n). Filters like ID(a) = x + 1, ID(b) = ID(a) + 1, reversed operands, inequalities, and multi-bound ranges now reduce a scan+filter to a NodeByIdSeek (previously only bare operands qualified). Also fixes a correctness bug where a per-record bound resolving to an empty range (non-integer / out-of-range value) dropped all remaining records instead of skipping just that one — e.g. UNWIND [1.1, 2, 3.5, 4] AS x MATCH (n) WHERE ID(n) = x now returns nodes 2 and 4. (#2870, fixes #2871)