chore(deps): move Node from EOL 20 to active LTS 24

[bketelsen]

Summary

The docs-gate job in .github/workflows/test.yml still provisioned Node.js 20, which is
end-of-life, and mise.toml pinned no Node version at all — so the CI runtime and the local
gate could drift apart silently.

This moves the gate to active LTS Node.js 24 and pins Node in mise.toml/mise.lock so both
sides resolve the same version:

• .github/workflows/test.yml: node-version: "20" → "24" (one line; the
  actions/setup-node SHA pin 820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 is
  unchanged, as are every other job, action pin, permissions block, and
  persist-credentials setting).
• mise.toml: added node = "24" to [tools] next to the untouched
  golangci-lint = "2.13.1".
• mise.lock: regenerated with mise lock (tool-generated, not hand-written) — the new
  [[tools.node]] block resolves 24.19.0 and carries per-platform checksums/URLs in exactly
  the same shape as the existing go and golangci-lint entries.

scripts/check-docs.mjs documents "Zero dependencies; Node >= 20" as a floor, so Node 24
satisfies it; no script logic was changed. No golangci-lint bump, no jdx/mise-action bump,
no go.mod/go.sum changes. AGENTS.md says "Node ≥ 20", which remains a correct floor, so
it is untouched.

Changed files (git diff origin/main --name-only):

.github/workflows/test.yml
mise.lock
mise.toml

Checks

• make fmt — SKIPPED: no Go sources changed by this PR (workflow/tool-pin files only).
• make ci — SKIPPED: not run locally. PR ci(make): run the docs-integrity gate inside make ci #403 (which moves the docs-integrity gate
  into make ci) is still open/unmerged, so the docs-gate was verified via its two
  current commands instead (see Verification). Full make ci runs on CI.
• CLI/e2e changes: go test -v ./cmd/updex ./tests/e2e/... — SKIPPED: not applicable,
  no Go code changed.
• New or changed behavior has focused tests — not applicable: no product behavior
  changed; the existing scripts/test-check-docs.mjs self-test suite covers the runtime
  and was run on Node 24 (see Verification).

Risk classification

• Tier 1: Low
• Tier 2: Moderate
• Tier 3: High

Rationale:

• Routine toolchain/runtime update (Node 20 → 24) confined to the non-privileged docs-gate
  CI job and local tool pins; it touches no security control, no Actions permissions, no
  action SHA pin, and no release or artifact-provenance path, but it does change the
  interpreter the docs gate executes under, so it is above documentation-only Tier 1.

Docs housekeeping

• Conformance aliases (ADR-0012) untouched — no docs files were modified at all.

Verification

• node scripts/check-docs.mjs green — run under Node 24:

$ mise exec -- node --version
v24.19.0
$ node scripts/check-docs.mjs
ok   docs_index_coverage: 1.000 (required 1)
ok   link_integrity: 1.000 (required 1)
ok   symlink_resolution: 1.000 (required 1)
checked: 20 docs, 277 links, 9 symlinks

• make test-docs-check green — the docs checker self-test, run under Node 24:

$ make test-docs-check
node scripts/test-check-docs.mjs
PASS: valid-fixture-passes
PASS: unindexed-category-document-fails
PASS: dead-relative-link-fails
PASS: broken-symlink-fails
PASS: escaping-symlink-fails
test-check-docs: all assertions passed

• mise install succeeds in the branch checkout and resolves Node 24:

$ mise install
mise all tools are installed
$ mise ls | grep -E '^(node|golangci-lint)'
golangci-lint  2.13.1   .../mise.toml  2.13.1
node           24.19.0  .../mise.toml  24
$ mise exec -- node --version
v24.19.0

• mise lock regenerated the lockfile (tool-generated):

$ mise lock
mise lock  ✓ 21 platform entries
✓ Updated 21 platform entries (0 skipped)
✓ Lockfile written to .../mise.lock

• Exactly one node-version in the workflow, and the workflow diff is one line:

$ grep -n 'node-version' .github/workflows/test.yml
228:          node-version: "24"

$ git diff origin/main -- .github/workflows/
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
@@ -225,7 +225,7 @@ jobs:
       - name: Set up Node.js
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: "20"
+          node-version: "24"

• Checked against the
  PR review rubric
  — SKIPPED: left for the reviewer; this PR is opened as a draft.