Description
The release branch still uses Node 24.22.0 in both dependency and runtime images. That predates the Node 24.22.1 eMudhra distrust fix. The Bugbot branch refresh and formatting repair do not remediate runtime certificate trust.
Acceptance Criteria
- #1 All selected Node build and runtime versions include the eMudhra fix, with compatible pins updated together
- #2 The published runtime CA package is verified against a patched distribution version and both incident hosts fail certificate verification
- #3 Existing local and exact-head CI gates pass before the patched release is published
Definition of Done
- #1 just check
- #2 just build
- #3 just test-e2e (only if packages/web behaviour changed)
Implementation Plan
Replace both Node image pins with the verified patched image digest; validate the existing gate and built runtime trust before publication.
Implementation Notes
Both verified Node 24.22.1 image stages install ca-certificates 20250419+deb13u1. Full just check and Docker build pass. Actual built runtime Node and OpenSSL clients reject both incident chains. Await exact-head CI and released image proof.