chore(ci): bump ci-base image node 22 -> 24-alpine

Follow-up to the CI cache work (#635/#637), sequenced separately so the
runtime-version change carries zero cache variables. node:24 is Active
LTS; node:26 is held until it reaches LTS (Oct 2026) since the Current
line risks node-gyp native-module breakage (better-sqlite3, canvas,
sharp, node-pty compile from source on the musl runner).

Only Dockerfile.ci's base changes; ci.yml/publish.yml comments updated
for accuracy. The ci-base image rebuilds automatically on merge (the
Dockerfile.ci path filter in ci-image.yml).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Dockerfile.ci

@@ -14,10 +14,12 @@
 # Rebuilt only when `pnpm-lock.yaml` or this Dockerfile change
 # (see .woodpecker/ci-image.yml).
 #
-# Node version is intentionally pinned to 22 (Active LTS at time of writing).
-# The node:22 -> node:24 bump lands as a SEPARATE follow-up PR so the cache
-# change carries zero runtime-version variables.
-FROM node:22-alpine
+# Node version is pinned to 24 (Active LTS). This is the follow-up bump from
+# node:22 — sequenced AFTER the CI cache work landed so the runtime change
+# carries zero cache variables. node:26 stays held until it reaches LTS
+# (Oct 2026); the Current line risks native-module (node-gyp) breakage on a
+# runner that compiles better-sqlite3 / canvas / sharp / node-pty from source.
+FROM node:24-alpine
 
 # Native toolchain required to compile node-gyp deps on musl, plus the
 # postgresql-client used by the test step's pg_isready readiness probe. `bash`