build: migrate CI and toolchain to Node 24, update dependencies

[simonharrer]

Summary

• Migrates all GitHub Actions to versions running on the Node 24 runtime, ahead of GitHub forcing Node 24 on June 16, 2026: checkout@v6, setup-node@v6, docker/setup-qemu@v4, docker/setup-buildx@v4, docker/login@v4, docker/build-push@v7, actions/attest-build-provenance@v4
• Uses Node 24 for builds in all workflows and the Dockerfile builder stage (node:24-slim); removes the 22.20.0 pin workaround in release.yml (it only existed because of a broken npm in the Node 22.22 toolcache)
• Updates all npm dependencies within their semver ranges (React 19.2.7, react-router-dom 7.17, tailwindcss 4.3, vite 7.3.5, @xyflow/react 12.11, zustand 5.0.14, Playwright 1.60, …)
• Fixes 9 DOMPurify XSS advisories (npm audit now reports 0 vulnerabilities) via an npm override forcing dompurify@^3.4.8

Why monaco-editor stays on 0.54

npm audit suggests monaco-editor 0.55.1 to fix the DOMPurify advisories, but 0.55 breaks the monaco-yaml web worker — the YAML editor loses validation, folding, and links, with repeated Missing requestHandler console errors (verified by A/B testing 0.54 vs 0.55 locally). The dompurify override fixes the advisories on its own since Vite resolves monaco's ESM dompurify import to the overridden version.

Not included (breaking major bumps, for a follow-up): eslint 10, vite 8, @vitejs/plugin-react 6, eslint-plugin-react-hooks 7, globals 17, open 11, monaco-editor 0.55.

Verification

• Production build passes
• Lint output identical before and after (93 pre-existing errors in bin/, unrelated to this change)
• npm audit: 0 vulnerabilities
• Playwright click-through on the dev server: app loads with zero console errors; Diagram/Form/YAML/Preview/Validation views render; adding a schema works; Form edits propagate to YAML and Preview; validation reports no issues