[3alpha]

Update the Node runtime to 24.22.1 and reject compressed JSON before decompression on the Brain, Launchpad, and UI APIs. This brings the 0.1.33 security hardening to main while preserving the Launchpad payload limit and keeping yarn.lock unchanged.

• Pin Docker images to node:24.22.1-alpine3.24, refresh CA packages, and align .nvmrc, engines, and CI.
• Add regression coverage for Brotli rejection (HTTP 415) and identity JSON on all three servers.
• Build Docker images on native AMD64 and ARM64 runners to avoid the QEMU illegal-instruction failure encountered during 0.1.33. Release builds use the checked-out requested tag, combine both architectures, and classify stable and prerelease tags correctly.

Validation: the application patch on this exact main base previously passed build, lint, and the full suite (130 passing, 1 skipped), including six HTTP encoding checks. Both updated workflows pass actionlint; git diff --check passes. The dependency lockfile is unchanged. No new release build or publication was requested or run for this PR.