P1: Plan Node 26 runtime and type-definition upgrade

[jusso-dev]

Why deferred

Dependabot PRs #1 and #8 move the runtime/type contract from Node 24 to Node 26. The #24 rollup intentionally remains on Node 24, which is the declared supported runtime and CI target. Applying only @types/node 26 would allow code to type-check against APIs unavailable in production Node 24; applying only the Dockerfile update would leave CI, Compose mocks, the distroless runtime, and engines inconsistent.

Upgrade matrix

Area	Current	Proposed	Disposition
Docker build image	node:24-bookworm-slim	node:26-bookworm-slim	Defer with full runtime cutover
Distroless runtime	nodejs24-debian13	Node 26 equivalent	Verify published, supported image before change
CI and security jobs	Node 24	Node 26	Change with the runtime cutover
Compose mock images	Node 24	Node 26	Change with the runtime cutover
package.json engines	>=24.0.0	Node 26 policy	Decide and document support window
@types/node	24.13.3	26.1.1	Update only after runtime policy changes

Required compatibility gates

• Confirm Node 26 is the supported production/LTS target for Muster and record the support policy.
• Update runtime, CI, Compose, and all @types/node manifests/lockfile together in one frozen-lockfile change.
• Run pnpm install --frozen-lockfile, pnpm check, database migrate/bootstrap/verify-clean, unit/integration and Chromium Playwright suites under Node 26.
• Build and start a clean linux/amd64 Docker Compose stack; verify web, worker, and agent gateway health.
• Run pnpm audit --audit-level high, licence/SBOM/container scans, CodeQL, and review new transitive packages/install scripts.
• Validate the GHCR amd64 manifest and rollback path from the preceding Node 24 image.

Source PRs

• build(deps): bump node from 24-bookworm-slim to 26-bookworm-slim #1 — Docker Node 24 → 26
• build(deps-dev): bump @types/node from 24.13.3 to 26.1.1 in the development group across 1 directory #8 — @types/node 24.13.3 → 26.1.1

Do not close either Dependabot PR until this replacement rollup has passed the listed gates.

[jusso-dev]

Deferred per tracker #78 item 10 and docs/operations/node-26-upgrade-deferral.md until Hermes MCP product gates are stable on Node 24. Do not merge isolated Dependabot Node 26 PRs (#1/#8).