chore: sweep dependabot updates and align Node 25 (#329)

* chore: sweep dependabot updates

* fix: narrow optional browser Buffer typing

* chore: align repo node pins to v25

scripts/dev/docker.workflow.test.ts

@@ -19,8 +19,10 @@ describe('docker workflows', () => {
   it('uses an armv7-capable node base image in the Dockerfile', () => {
     const dockerfile = readFileSync(resolve(process.cwd(), 'docker/Dockerfile'), 'utf8');
 
-    expect(dockerfile).toContain('FROM node:22-bookworm-slim AS builder');
-    expect(dockerfile).toContain('FROM node:22-bookworm-slim');
+    const fromMatches = [...dockerfile.matchAll(/^FROM node:(\d+)-bookworm-slim(?: AS builder)?$/gm)];
+
+    expect(fromMatches).toHaveLength(2);
+    expect(fromMatches[0]?.[1]).toBe(fromMatches[1]?.[1]);
   });
 
   it('keeps server docker builds isolated from desktop packaging dependencies', () => {

scripts/dev/harness.workflow.test.ts

@@ -16,7 +16,7 @@ describe('harness workflows', () => {
     expect(driftWorkflow).toContain('schedule:');
     expect(driftWorkflow).toContain('workflow_dispatch:');
     expect(driftWorkflow).toContain('npm run repo:drift-check -- --format markdown --output tmp/repo-drift-report.md --report-only');
-    expect(driftWorkflow).toContain('actions/upload-artifact@v4');
+    expect(driftWorkflow).toMatch(/actions\/upload-artifact@v\d+/);
     expect(driftWorkflow).toContain('repo-drift-report');
   });
 });