pages: pin node-version to 25.9.0 on the shared setup-and-install

Previously relying on the shared action's default. Making it explicit
in the workflow so the Node version this build runs under is visible
without chasing into socket-registry. Matches fleet standard.

Also drop an overexplained comment in walkthrough.mts (sriForUrl).

Author: jdalton

.github/workflows/pages.yml

@@ -60,6 +60,7 @@ jobs:
         uses: SocketDev/socket-registry/.github/actions/setup-and-install@d7b5d15a9be8973a5715459d12b9a033603a5ff5 # main
         with:
           checkout-fetch-depth: '1'
+          node-version: '25.9.0'
 
       # The fleet's shared checkout action doesn't init submodules.
       # We need upstream/meander because the generate step shells out

scripts/walkthrough.mts

@@ -171,11 +171,6 @@ async function sriForUrl(url: string, cacheDir: string): Promise<string> {
     throw new Error(`SRI fetch ${url} → HTTP ${res.status}`)
   }
   const bytes = new Uint8Array(await res.arrayBuffer())
-  // `crypto.hash` is the Node 21+ one-shot helper — base64-encodes
-  // the sha384 digest in a single call. Equivalent to the
-  // createHash(...).update(...).digest('base64') dance but shorter.
-  // SRI format itself is just `<algo>-<base64hash>`; no stdlib helper
-  // does the string prefix, so we build that ourselves.
   const integrity = `sha384-${cryptoHash('sha384', bytes, 'base64')}`
   mkdirSync(cacheDir, { recursive: true })
   writeFileSync(cachePath, integrity + '\n')