feat: Node.js 24 and 26 images; refuse builds below the Oct 2026 security floor

- One install-node.sh <major> replaces install-node{18,20,22}.sh. It fails the
  build if NodeSource hands back a version below the newest security release
  for the line (22.23.4 / 24.22.1 / 26.12.1: CVE-2026-111497 Brotli OOB write
  and 9 others), so a lagging mirror can't ship a vulnerable image silently.
  18 and 20 are EOL: they still build, with a warning.
- CI matrix adds 24 and 26; fail-fast off so one line can't cancel the rest.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

scripts/install-node.sh

@@ -0,0 +1,33 @@
+#!/usr/bin/env bash
+# Install Node.js <major> from NodeSource, then refuse a build whose version is
+# below the newest security release for that line. NodeSource mirrors can lag
+# a release, and without this check a stale mirror ships a vulnerable image
+# that looks like a normal successful build.
+#   usage: install-node.sh <major>
+set -euo pipefail
+major="${1:?usage: install-node.sh <major>}"
+case "$major" in ''|*[!0-9]*) echo "bad Node major: $major" >&2; exit 64;; esac
+
+# Minimum acceptable version per line. Raise these when Node.js publishes a
+# security release. 18 and 20 are end of life and get no fixes upstream.
+declare -A MIN=(
+  [22]=22.23.4   # 2026-10-20 security release (CVE-2026-111497 Brotli, +9)
+  [24]=24.22.1
+  [26]=26.12.1
+)
+
+wget -qO- "https://rpm.nodesource.com/setup_${major}.x" | bash -
+dnf install -y nodejs
+npm install -g npm@latest
+
+have="$(node -p 'process.versions.node')"
+case "$have" in "$major".*) ;; *) echo "ERROR: wanted Node $major, got $have" >&2; exit 1;; esac
+if [ -n "${MIN[$major]:-}" ]; then
+  if [ "$(printf '%s\n%s\n' "${MIN[$major]}" "$have" | sort -V | head -1)" != "${MIN[$major]}" ]; then
+    echo "ERROR: Node $have is below the security floor ${MIN[$major]} for line $major (mirror behind?)" >&2
+    exit 1
+  fi
+else
+  echo "WARNING: Node $major is end of life; this image gets no Node.js security fixes." >&2
+fi
+echo "node $have, npm $(npm --version)"