ci: give Node one source of truth, and move it to 26

[FrameAutomata]

Closes #333. You asked to lock it down and tighten it "to like 26" — this does both: .nvmrc becomes the single source of truth, and the pin moves 22 → 26.

Before

Ten sites naming a Node major, nothing asserting they agree — and two of them not naming one at all:

site	was
release-traceway.yml	node-version: 22
benchmark-processor.yml	node-version: 22
release-docs.yml, release-website.yml	node-version: "latest"
Dockerfile, .minimal, .sqlite, .duckdb, .browser (×2)	node:22-alpine / node:22-bookworm-slim
flake.nix	regex over engines.node

"latest" resolves to Node Current, which the runner tool cache never ships — so every docs and website deploy was re-downloading a Node tarball before it could start.

After

.nvmrc  ->  4× setup-node    node-version-file: .nvmrc
        ->  flake.nix        dev shells
        ->  release-traceway --build-arg NODE_VERSION, all 5 image builds

engines.node stays ">=22". It is deliberately not the pin. That field is the floor npm enforces on consumers, and pointing node-version-file at it is exactly what f95424cc was fixing — node-version-file resolves a range to the newest satisfying release, so ">=22" silently meant "latest". Reading .nvmrc restores the mechanism f95424cc had to abandon, without reintroducing the bug that made it abandon it.

The Dockerfiles keep an ARG NODE_VERSION=26 default, because a bare docker build has no way to read .nvmrc. That default is now the only value in the repo that can drift — so scripts/check-node-pins.sh asserts it matches, and release-traceway.yml runs it before it builds anything. It also fails on a literal node:<major> tag reintroduced into a FROM, which would ignore both .nvmrc and the ARG.

I confirmed it actually catches both, rather than assuming:

$ sed -i 's/ARG NODE_VERSION=26/ARG NODE_VERSION=22/' Dockerfile.sqlite
check-node-pins: Dockerfile.sqlite pins Node 22, .nvmrc says 26          exit 1

$ # reintroduce node:24-alpine in Dockerfile.duckdb
check-node-pins: hardcoded node tag, use ${NODE_VERSION}:
Dockerfile.duckdb:20:FROM --platform=$BUILDPLATFORM node:24-alpine ...   exit 1

One thing worth your call: 26 is not LTS until October

Node is a build-time dependency in every image except :browser, which copies the node binary into its runtime stage to execute Playwright specs (Dockerfile.browser:80). So that image is the one place the major is load-bearing at runtime, and Node 26 reaches LTS in October 2026 — about five weeks out.

I've shipped 26 as asked. If you'd rather be on the current LTS, 24 is a one-line change to .nvmrc plus the five ARG defaults, and the check script tells you if you miss one. That is the point of the change more than the number is.

Verification

npm ci / build / test / check on nodejs 26.7.0	pass — 25 tests, 0 svelte-check errors
All four nix dev shells	evaluate, hand out v26.7.0
scripts/check-node-pins.sh	passes clean, fails on both drift shapes above
Workflows	no literal node-version: remains

Not verified: no container runtime available here, so the five image builds were not run. The ARGs are global — declared before the first FROM in every file, which I checked mechanically — which is what makes them usable in a FROM.

Out of scope, deliberately

• testing/devtesting-nestjs/Dockerfile stays on node:20-alpine. The issue names it as existing drift, but it pins the runtime of a sample third-party app rather than anything Traceway builds; coupling it to our frontend's pin would be wrong. (It is on an EOL major, which is its own question.)
• docs/pages/client/js-sdk/sourcemap-upload.mdx keeps a literal — it is a copy-pasteable recipe for readers who have no .nvmrc.
• ci: test the frontend on every labelled PR #315's frontend.yml uses node-version-file: frontend/package.json, which has the resolve-to-latest behaviour described above. Different file, so no conflict either way; whichever of the two lands second should switch it to .nvmrc. I'll do that on ci: test the frontend on every labelled PR #315 if this goes first.

🤖 Generated with Claude Code