[yumike]

Summary

Pin the seven Node 24 setup steps to 24.22.1, the security-patched runtime selected by the latest main CI run. Floating major selectors can install newer patches than the version Renovate evaluated for its release-age policy.

• Keep action SHA pins, Node engine minimums, native-test Docker images, and Renovate configuration unchanged.
• Document why CI runtime pins must use exact patch versions, independently of supported development-toolchain minimums.
• Keep the Node 26 upgrade in chore(deps): update dependency node to v26 #1334 separate.

Release-age gate

The Actions Node 24.22.1 distribution was published on October 21 at 14:43:51 UTC. Its 14-day cutoff is November 4, 2026, at 14:43:51 UTC. Do not merge earlier without an explicit exception; this PR does not waive the policy. The pin retains the security fixes rather than reverting to an older, age-eligible patch.

Validation

Using the checksum-verified official Node 24.22.1 distribution and npm 11.19.1:

• npm ci, make format, viewer and root lint, and Svelte checking passed.
• All 925 viewer tests passed; application and library builds passed.
• Built the native addon with the locked Rust dependency graph; all 39 native tests passed, with no generated-binding drift.
• Parsed the workflows and verified that their only changes are the seven exact-version substitutions.
• Confirmed that Renovate's native GitHub Actions manager recognizes the exact runtime pins without additional configuration.