chore(security): patch devcontainer Node and refresh CI binaries

.devcontainer/Dockerfile

@@ -1,6 +1,20 @@
-ARG VARIANT="24"
+ARG VARIANT="24-bookworm"
 
-FROM mcr.microsoft.com/vscode/devcontainers/javascript-node:${VARIANT}
+FROM node:24.22.1-bookworm-slim@sha256:55fb5f5a527ea2c5c4a95f963e48ef90aa38c7b346054fdc8ee9957a2b55d205 AS patched-node
+
+FROM mcr.microsoft.com/devcontainers/javascript-node:${VARIANT}
+
+# Patch the system binary and every inherited nvm copy used by interactive shells.
+COPY --from=patched-node /usr/local/bin/node /tmp/patched-node
+RUN install -m 0755 /tmp/patched-node /usr/local/bin/node \
+ && if [ -d /usr/local/share/nvm/versions/node ]; then \
+      find /usr/local/share/nvm/versions/node -type f -path "*/bin/node" \
+        -exec install -m 0755 /tmp/patched-node {} \; ; \
+    fi \
+ && rm /tmp/patched-node \
+ && test "$(node --version)" = "v24.22.1" \
+ && test "$(/usr/local/bin/node --version)" = "v24.22.1"
+ENV NODE_VERSION=24.22.1
 
 USER node
 WORKDIR /home/node

.devcontainer/devcontainer.json

@@ -3,7 +3,7 @@
   "build": {
     "dockerfile": "Dockerfile",
     "args": {
-      "VARIANT": "24"
+      "VARIANT": "24-bookworm"
     }
   },
   "extensions": [

.github/actions/setup/action.yml

@@ -24,12 +24,14 @@ runs:
       if: inputs.install_dependencies == 'true'
       with:
         node-version: ${{ inputs.node_version }}
+        check-latest: true
         registry-url: ${{ inputs.registry_url }}
     - name: Setup Node.js without cache
       uses: actions/setup-node@v7
       if: inputs.install_dependencies == 'false'
       with:
         node-version: ${{ inputs.node_version }}
+        check-latest: true
         registry-url: ${{ inputs.registry_url }}
     - name: Install dependencies
       if: inputs.install_dependencies == 'true'

.github/workflows/check.yml

@@ -77,6 +77,7 @@ jobs:
         uses: actions/setup-node@v7
         with:
           node-version: ${{ matrix.node }}
+          check-latest: true
       - name: Download artifact
         uses: actions/download-artifact@v8
         with: