[benbrandt]

Summary

• Resolve the newest Node LTS patch before consulting the runner tool cache in both CI and npm publishing.
• Keep node-version: "lts/*", pinned action revisions, npm settings, package versions and library APIs unchanged.

Why

The October 22 CI run selected cached Node 24.21.0, and publishing selected 24.22.0, both older than 24.22.1, which fixes the October 21 Node security release, including CVE-2026-111497.

Evidence: CI run, publish run.

Validation

• Baseline on local Node 24.22.0: npm ci && npm run check passed, including 490 tests.
• After on official Node 24.22.1 (archive SHA-256 verified): npm ci && npm run check passed, including the same 490 tests, generated-source checks, lint, formatting, spelling, typecheck, build, package contents and TypeDoc verification.
• Existing npm deprecation/install-script warnings were present before and after; no new failures observed.
• Parsed both workflow files and verified all setup-node steps retain lts/* with check-latest: true.
• Tests ran natively on macOS; actual GitHub-hosted runner resolution remains to be confirmed by this PR's CI. No package was published.

Risk / rollout

Low-risk CI-only runtime freshness change. On the next CI/publish job, check the setup-node log resolves at least 24.22.1 for Node 24. Reverting this PR restores cache-first selection and can restore an unpatched runtime; it is not a security mitigation.

This fixes our tooling, not consumers' independently installed Node runtimes.