[aharlap]

Bump the shared bundled Node runtime to 24.22.1 for the 2026-10-20 Node security release. Update all four runtime URLs and SHA-256 pins, preserved provenance, README, both CI Node versions, the package engine floor, and current-pin tests and fixtures. Historical shipped-manifest fixtures and their signed checksum evidence are unchanged.

Verification used the existing public key in docs/provenance/node-release-key.asc, with WSL Ubuntu-24.04 GnuPG 2.4.4 and a fresh scratch keyring:

curl --fail --location --output SHASUMS256.txt.asc https://nodejs.org/dist/v24.22.1/SHASUMS256.txt.asc
mkdir -m 700 gnupg
gpg --homedir gnupg --batch --import /path/to/rubato/docs/provenance/node-release-key.asc
gpg --homedir gnupg --batch --status-fd 1 --verify SHASUMS256.txt.asc
gpg --homedir gnupg --batch --output SHASUMS256.txt --decrypt SHASUMS256.txt.asc

GOODSIG and VALIDSIG confirmed the recorded fingerprint 5BE8A3F6C8A5C01D106C0AD820B1A390B168D356. No new key was trusted. The verified cleartext and signed list are preserved in docs/provenance/node-v24.22.1-SHASUMS256.txt and .txt.asc.

Each filename was read from the verified list, downloaded from the official version directory with curl.exe --fail --location --output <file> <url>, and checked with Get-FileHash -LiteralPath <file> -Algorithm SHA256 against its signed entry:

• darwin-arm64.tar.gz: 89c682593d76cd44233fa53b1563264e7de9cbb189cad169135c5b4fadfbc0a7, 53,062,778 bytes.
• darwin-x64.tar.gz: d132557e7ee2b85af08b0c8c34338e65c6430f2238d01f727728ef42dc83b035, 54,382,566 bytes.
• linux-x64.tar.gz: eb6728e77c576a35162c122c45ccadf224d89ff00abc8dae46cc2897c6002d7c, 58,290,700 bytes.
• win-x64.zip: d2046d28c2c3dcd211ac5145c0bf30e2047ef9dfb306693c8c6e2eccd8b95fa5, 37,748,064 bytes.

The manifest does not carry archive sizes, so no size fields were added.

Checks, using Node 24.22.1 extracted from the verified Windows and Linux archives:

• npm.cmd run validate: passed.
• npm.cmd run validate:release: passed; validation only, no publishing.
• node --test test/manifest.test.mjs test/skills.test.mjs test/ci-manifest.test.mjs: 107 passed on Windows.
• Updated manifest tests were run before changing the pins: three failures, covering both native Mac archive URLs and preserved hash evidence.
• node --test test/install-launcher.test.mjs test/install.test.mjs: 37 passed in WSL Ubuntu-24.04 with TMPDIR=/tmp.
• An initial WSL selection command lacked ripgrep and started an unintended full suite, which was cancelled. It observed an XZ installer timeout and a POSIX execute-bit failure with temporary homes on DrvFS. Both affected cases passed when rerun explicitly with TMPDIR=/tmp, 2/2 tests. No acceptance checks were relaxed.
• git diff --check: passed.

Ubuntu and both native macOS CI jobs remain the full integration gate.

Studio write smoke (added after Studio #1864): Node 24.22 blocks fsync under the Permission Model. Rubato launches tools without --permission, so installs are unaffected, but the doctor only runs read-only inspect. The macOS real-install job now runs praxity identity init on a fresh course and checks the output and .praxity/identity/course.json.

Review: 0/0/0; fixes 0. Opus controller review; hashes rechecked against nodejs.org SHASUMS256.txt, signed file identical.
🤖 Generated with Claude Code

[aharlap]

On hold: Node 24.22.1 disables fsync when the Permission Model is on (ERR_ACCESS_DENIED). Studio's CLI, which Rubato runs on this bundled Node, fsyncs under --permission, so lesson saves would fail. Waiting for the Studio fix before merging.