[axAilotl]

Summary

• upgrade every authoritative Node.js runtime, CI, package-engine, and container pin from 24.19.0 to the CVE-2026-111497-fixed 24.22.1 release
• pin node:24.22.1-slim to the official multi-platform digest
• refresh the Debian jq security-package pin required by that base image
• enforce the full 24.22.1 semver floor in the local tool doctor
• preserve exclusive fleet-restore staging under Node's corrected cpSync errorOnExist behavior

Validation

• 60 focused CI/runtime-contract tests passed
• 35 fleet-restore compatibility tests passed under Node 24.22.1
• 19,236 unit tests, 854 integration tests, 317 satellite-hub TypeScript tests, 56 satellite-hub Python tests, and 108 eval tests passed in the pre-PR gate
• production build and changed-file lint passed
• pinned container digest reports Node v24.22.1

Change-budget exception

This urgent runtime security patch must update all authoritative version seams together. The repeated pins span 33 files but contain only 131 substantive changed lines; splitting them would temporarily leave CI, local development, documentation, or container builds on the vulnerable runtime.

Tracked by psfn-framework-tbddk.