ci: enforce the declared Node runtime floor

[CodeinScrubs]

Summary

• run the existing Node 22 and Node 24 quality/packed-consumer contexts on exact 22.12.0 and 24.15.0 runtimes while preserving their branch-protection names
• pin the remaining CI/demo/benchmark runtime selections instead of floating across major lines
• document the Corepack 0.34.1 bootstrap required to authenticate pnpm 10.27.0 on Node 22.12
• intentionally ignore jsdom major updates while jsdom 30 requires Node 22.22.2/24.15.0 and BidiLens supports Node 22.12
• correct the current branch-protection documentation to 18 contexts, including all three Rust platforms and enforced administrator checks

Evidence

• complete pnpm run check and actionlint pass locally
• exact portable Node 22.12.0 + pnpm 10.27.0 passed all 396 tests, the 930-case corpus, docs, builds, and action checks
• Node 22.12's bundled Corepack reproduced a signing-key failure; Corepack 0.34.1 authenticated the pinned pnpm successfully
• git diff --check and documentation validation pass

After merge, repository protection will be updated to require the three already-existing Rust job contexts. Dependabot PR #10 will then be closed with the compatibility rationale.