ci: add Node 26 preview gate

[cucuwang]

Problem and change

Exercise Node 26 as a non-blocking preview without changing the supported runtime or the required Node 22/24 matrix. The preview job does not upload candidate manifests, so release reproducibility remains limited to the two required runtimes.

Validation and impact

• Tests/build pass: npm run check completed with 21 files, 275 tests and the TypeScript build.
• CLI, API, JSON and Action contracts are unchanged; the full release gate passed on Node 26.8.2 for the current main source.
• Security and dependency impact reviewed; workflow permissions and pinned Action SHAs are unchanged, and npm audit reported 0 vulnerabilities.
• No scoring or methodology changes.
• No user-facing behavior changed, so documentation and changelog updates are not required.
• The preview job is informational, produces no release artifact, and does not change package contents.

For reviewers

Confirm that the Node 26 preview remains isolated from the required release-candidate reproducibility artifacts.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.