ci(hermes): qualify the fixture Node interpreter

Remove group/world write bits from the dedicated CI job's Node interpreter,
matching the protected paid workflow setup. Preserve the Rust launch verifier
and record the first Linux fixture result and interrupted PR checks.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

.github/workflows/runner-hermes-native.yml

@@ -46,6 +46,17 @@ jobs:
         with:
           version: 9.15.4
 
+      - name: Qualify the job's provider Node interpreter
+        run: |
+          node <<'NODE'
+          const fs = require('node:fs');
+          const mode = fs.statSync(process.execPath).mode & 0o777;
+          fs.chmodSync(process.execPath, mode & ~0o022);
+          if ((fs.statSync(process.execPath).mode & 0o022) !== 0) {
+            throw new Error('provider Node interpreter remains group- or world-writable');
+          }
+          NODE
+
       - name: Install workspace dependencies
         run: |
           set -euo pipefail