fix(deps): pin Node 24.22.1 for the October 21, 2026 security release

Node.js 24.14.0 carries CVE-2026-111497 ("Node2Shell"), an out-of-bounds
write in the bundled Brotli decoder that can lead to remote code
execution, plus several high-severity DNS, TLS and URL-parsing fixes.
24.22.1 is the first patched 24.x release.

- Dockerfile: node:24.22.1-slim, digest re-pinned to the multi-arch index
- CI: 24.22.1 in the verify matrix and the other two jobs; the
  allocation-gate requirement now keys on 24.22.1
- Docs: contributor setup and the dependency baseline name 24.22.1

The engines floor and the setup doctor are unchanged.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

README.md

@@ -129,8 +129,9 @@ hardware; it does not establish a minimum GPU requirement.
 
 ### Path 2 — Terminal / coding agent
 
-Use **Node.js 24.x (24.14.0 or later) or 26.x**. The setup doctor warns about
-Node 25, which is end-of-life.
+Use **Node.js 24.x (24.14.0 or later) or 26.x**; 24.22.1 or later (26.12.1 or
+later on 26) includes the October 21, 2026 security fixes, among them
+CVE-2026-111497. The setup doctor warns about Node 25, which is end-of-life.
 
 ```bash
 git clone https://github.com/bilawalsidhu/gods-eye-view.git