fix(ci): enforce minimum Node version on pinned images

Co-Authored-By: Paperclip <noreply@paperclip.ing>

scripts/node-image-policy.mjs

@@ -1,5 +1,7 @@
 // Accept the existing major tags and exact patch pins, with a required image variant.
 // A digest, when present, must be a complete SHA-256 pin.
 export function isNode24ImageTag(tag) {
-  return /^24(?:\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*))?-[a-z0-9][a-z0-9._-]*(?:@sha256:[a-f0-9]{64})?$/.test(tag);
+  const match = /^24(?:\.(0|[1-9]\d*)\.(?:0|[1-9]\d*))?-[a-z0-9][a-z0-9._-]*(?:@sha256:[a-f0-9]{64})?$/.exec(tag);
+  // Floating major tags follow Node 24; exact pins must meet engines.node >=24.11.0.
+  return match !== null && (match[1] === undefined || BigInt(match[1]) >= 11n);
 }

scripts/standard-image-contract.test.mjs

@@ -5,7 +5,7 @@ import { standardImageDigest, resolveStandardImageDigest } from "./standard-imag
 import { isNode24ImageTag } from "./node-image-policy.mjs";
 
 test("Node image policy accepts Node 24 major tags and exact security pins", () => {
-  for (const tag of ["24-trixie-slim", "24-bookworm-slim", "24-alpine3.23", "24.21.0-bookworm",
+  for (const tag of ["24-trixie-slim", "24-bookworm-slim", "24-alpine3.23", "24.11.0-bookworm", "24.21.0-bookworm",
     `24.21.0-bookworm@sha256:${"a".repeat(64)}`, `24-bookworm@sha256:${"0".repeat(64)}`]) {
     assert.equal(isNode24ImageTag(tag), true, tag);
   }
@@ -13,6 +13,7 @@ test("Node image policy accepts Node 24 major tags and exact security pins", ()
 
 test("Node image policy rejects other majors, partial versions and malformed pins", () => {
   for (const tag of ["240-bookworm", "25.21.0-bookworm", "v24.21.0-bookworm", "latest",
+    "24.0.0-bookworm", "24.10.0-bookworm", "24.10.99-bookworm",
     "24.21-bookworm", "24.21.0", "24.21.0-", "24..21.0-bookworm", "24.021.0-bookworm",
     "24.21.0-bookworm@sha256:short", `24.21.0-bookworm@@sha256:${"a".repeat(64)}`,
     `24.21.0-bookworm@sha256:${"a".repeat(64)}junk`, "${NODE_VERSION}-bookworm", "24-$(whoami)"]) {