Validation only: Node and Docker Actions upgrades
Validation only; do not merge.
This branch contains the combined #259, #260, and #261 updates plus one temporary workflow. The workflow exercises setup-node 7 with the npm registry configuration used by SDK release installs, both frozen installs, SDK checks, Buildx 4, GHCR login 4, Docker metadata 6, and build-push 7. It builds and loads a local image, then verifies Node and the compiled server/migration files. Package permissions are read-only and push is false. The workflow will not enter main; this PR will be closed after proof is collected.
Summary by cubic
Validation-only branch; do not merge.
Combines the setup-node 4→7, docker/metadata-action 5→6, and docker/build-push-action 6→7 upgrades across the CI, release, security, and TypeScript SDK workflows, and adds one temporary workflow to prove the upgrades work together before they land in main. The validation workflow runs setup-node 7 with the npm registry config used by SDK releases, frozen installs, and TypeScript checks, then builds and loads a local image with Buildx 4, GHCR login 4, metadata 6, and build-push 7, verifying Node and the compiled server and migration files. Permissions are read-only and push is false. The temporary workflow will not enter main; this PR will be closed once proof is collected.