[Mister-Hope]

Summary

Harden the CI/dev Node.js runtime and unify CI Node setup:

• Pin the development/CI Node.js runtime to releases containing the fixes from the October 2026 Node.js security releases: Node.js 22 → 22.23.4, 24 → 24.22.1, 26 → 26.12.1.
• Replace the pnpm/action-setup + actions/setup-node pair with a single pnpm/setup@v3 step. actions/setup-node may install a stale cached patch of a major line, which then trips pnpm ci against the devEngines.runtime range; pnpm/setup downloads the runtime from the Node dist index.

Changes

• .github/workflows/docs.yml
  • pnpm/action-setup@v6 + actions/setup-node@v6 (node-version: 24) → pnpm/setup@v3 with runtime: node@^24.22.1
• .github/workflows/check-docs.yml
  • pnpm/action-setup@v6 + actions/setup-node@v6 (node-version: ${{ matrix.node }}) → pnpm/setup@v3 with runtime: node@${{ matrix.node }}; the matrix entries stay majors (22, 24), which pnpm/setup resolves to the latest (fixed) patch
• package.json
  • devEngines.runtime.version: ^22.18.0 || ^24.0.0 || ^26.0.0 → ^22.23.4 || ^24.22.1 || ^26.12.1

Notes

• Only the development/CI environment is pinned to the fixed releases. Consumer-facing requirements are unchanged — the docs still state the Node.js v22.18.0+ prerequisite and no engines.node field is modified.
• CI will validate the change when this PR runs.

Verification

• Every changed file parsed successfully: package.json with JSON.parse, both workflows with yaml.
• git diff shows only Node version pins and the setup-action conversion — 3 files, no lockfile changes, no formatting churn.