security(runtime): upgrade patch-validator Node for bundled Undici fix #734

Problem

Noema's protected-base patch-validator image pins a fully static Node.js 24.19.0 runtime. Exact image evidence from PR #733 patch-validator run 36504105548, artifact 11031436406, identifies bundled Undici 7.29.0 and reports GHSA-3wwx-pv8p-q78v. The advisory is fixed in Undici 7.29.1.

This is a canonical Noema runtime defect, not an App-installation-consent defect introduced by #733. It must not be waived, severity-downgraded, or worked around in a consumer.

Root cause

The protected base and its exact-identity contracts still pin Node 24.19.0 across the static-image Dockerfile, hosted workflows, package-manager identity, embedded-runtime inventory/evidence, tests, and documentation. Node 24.19.0 embeds Undici 7.29.0. The official Node v24.21.0 release bundle contains Undici 7.29.1.

Required RED evidence

1. Add a durable exact-runtime test that fails on the protected-base identity because process.versions.undici is below 7.29.1 or because the exact image vulnerability evidence contains GHSA-3wwx-pv8p-q78v.
2. Preserve the current full scanner receipt; do not replace it with a string-only or vacuous oracle.
3. Confirm every toolchain and image pin affected by the version transition before editing.

Smallest GREEN repair

• Select the smallest supported Node release whose official source bundle contains Undici >= 7.29.1; Node v24.21.0 is the currently verified LTS candidate.
• Authenticate the official source tarball with its exact SHA-256 and update the static build identity, CPE/package note, embedded-runtime catalog/inventory, applicability evidence, and all executable exact-version gates.
• Determine and pin the bundled npm version from the exact selected runtime; do not guess or retain a contradictory npm assertion.
• Update package-manager metadata, affected workflows, tests, CHANGELOG, runtime/operator documentation, and security doctoring as one coherent owner delta.
• Preserve the existing c-ares overlay and all independently justified applicability decisions unless exact new evidence changes them.
• Do not add a scanner ignore, advisory waiver, mutable download, branch URL, or paid/model fallback.

Completion gates

• Focused RED→GREEN evidence for bundled Undici identity and GHSA absence.
• Full test/typecheck/coverage GREEN.
• Patch-validator image build, smoke, SBOM, provenance, and vulnerability verification GREEN on the exact PR head.
• Fresh exact-head review and qualifying independent approval.
• Ordinary merge, immutable Noema release/evidence, then dependent PRs may consume the released owner fix.

Dependency

PR #733 must remain Draft / Proposed while this owner prerequisite is unresolved. A diagnosis or this issue alone is not completion.