security: move runtime to Node 24 and Debian 13

[ty-everett]

Summary

• migrate the pinned production base from Node 22/Bookworm to supported Node 24 LTS/Debian 13
• add a weekly and runtime-change Linux/amd64 image build outside Evans Creek
• scan the exact candidate with digest-pinned Trivy 0.73.0 and reject critical or fixable-high findings

Safety

• this PR does not deploy production
• the heavy candidate build runs on a GitHub-hosted runner, avoiding Starlink data and production cluster capacity
• production remains on the current known-good image until the image policy and application CI pass

Local validation

• npm audit --omit=dev --audit-level=high
• npm run lint
• npm run typecheck
• npm test (26 tests)
• npm run build
• bash -n scripts/k8s/build-local-image.sh
• workflow YAML parse and git diff --check