ci: pin Node 24 runtime to an exact patch

.github/workflows/build-npm.yml

@@ -72,7 +72,7 @@ jobs:
       - name: Set up Node.js
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          node-version: "24"
+          node-version: "24.22.1"
 
       - name: Install dependencies
         run: npm ci
@@ -160,7 +160,7 @@ jobs:
       - name: Set up Node.js
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          node-version: "24"
+          node-version: "24.22.1"
 
       - name: Install dependencies
         run: npm ci

.github/workflows/ci.yml

@@ -131,7 +131,7 @@ jobs:
       - name: Set up Node.js
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          node-version: "24"
+          node-version: "24.22.1"
 
       - name: Install frontend dependencies
         run: npm ci
@@ -197,7 +197,7 @@ jobs:
       - name: Set up Node.js
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          node-version: "24"
+          node-version: "24.22.1"
 
       - name: Install frontend dependencies
         run: npm ci
@@ -251,7 +251,7 @@ jobs:
       - name: Set up Node.js
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          node-version: "24"
+          node-version: "24.22.1"
 
       - name: Install frontend dependencies
         run: npm ci

.github/workflows/publish-npm.yml

@@ -17,7 +17,7 @@ jobs:
       - name: Set up Node.js
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          node-version: "24"
+          node-version: "24.22.1"
           registry-url: "https://registry.npmjs.org"
 
       - name: Install dependencies
@@ -71,7 +71,7 @@ jobs:
       - name: Set up Node.js
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          node-version: "24"
+          node-version: "24.22.1"
           registry-url: "https://registry.npmjs.org"
 
       - name: Download viewer build

AGENTS.md

@@ -49,6 +49,8 @@ Open the matching file before working in that area:
   records (`""` and `"packages/viewer"`). The range tracks the dev toolchain,
   not the shipped package: patch floors come from the lint tools, Node 23 and
   25 are excluded to match Vitest 5, and Node 20 is end-of-life.
+  CI runtime pins are separate from these minimums: use exact patch versions
+  so floating selectors cannot bypass Renovate's release-age policy.
 
 ## Generated files