Pin provider-pack producer Node to the image version

Co-Authored-By: Paperclip <noreply@paperclip.ing>

.github/workflows/release-verify.yml

@@ -581,7 +581,8 @@ jobs:
           version: 9.15.4
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
         with:
-          node-version: 24
+          # Provider-pack Node bytes must match the pinned Daytona image.
+          node-version: 24.21.0
       - name: Bind immutable producer source and target
         id: identity
         env:

scripts/__tests__/release-verify-workflow.test.mjs

@@ -786,6 +786,13 @@ function nativeProducer() {
   return readWorkflow('release-verify.yml').split('  runner_binaries:\n')[1];
 }
 
+test('native provider packs and the image use the same exact Node version', () => {
+  const version = nativeProducer().match(/node-version: ([0-9.]+)/)?.[1];
+  assert.equal(version, '24.21.0');
+  const image = readFileSync(path.join(repoRoot, 'docker/daytona-runner/Dockerfile'), 'utf8');
+  assert.ok(image.includes(`FROM node:${version}-bookworm@sha256:`));
+});
+
 test('native dependency caches are target-bound and unmerged master callers cannot save them', () => {
   const producer = nativeProducer();
   const cache = producer.split('      - name: Cache native Rust dependencies\n')[1].split('\n      - ')[0];

scripts/check-node-version-policy.mjs

@@ -40,7 +40,15 @@ const workflowRoot = path.join(repoRoot, ".github", "workflows");
 walk(workflowRoot, (filePath) => {
   if (!/\.ya?ml$/.test(filePath)) return;
   const source = fs.readFileSync(filePath, "utf8");
+  // Release packs ship the interpreter itself, so their producer must match
+  // the image's exact Node patch. Other CI jobs continue tracking Node 24.
+  const packProducer = relative(filePath) === ".github/workflows/release-verify.yml"
+    ? /(?:^|\n)  runner_binaries:\n[\s\S]*?(?=\n  [a-z_]+:\n|$)/.exec(source)
+    : null;
   for (const match of source.matchAll(/node-version:\s*["']?([^\s"'#]+)/g)) {
+    if (match[1] === "24.21.0" && packProducer
+      && match.index >= packProducer.index
+      && match.index < packProducer.index + packProducer[0].length) continue;
     if (match[1] !== "24") failures.push(`${relative(filePath)}: node-version must be 24, found ${match[1]}`);
   }
 });