chore: move the css build stage to node 24 LTS

[av1155]

What

Dependabot proposed node:22-alpine to node:25-alpine in #743. That build fails:

/bin/sh: corepack: not found
ERROR: process "/bin/sh -c corepack enable" did not complete successfully: exit code: 127

Node 25 no longer bundles corepack, and the Dockerfile uses corepack enable to get pnpm.

Why

Two separate problems with that bump.

Node 25 is not an LTS line (lts: false in the Node release index). Node 24 is the current LTS, Krypton. A build image for a self-hosted product should track LTS, and Dependabot has no concept of LTS so it will keep proposing Current releases.

Node 24 still bundles corepack, so moving there needs no change to how pnpm is installed. Verified against the pinned digest: Node v24.19.0, corepack enable succeeds, pnpm 11.21.0 activates.

Proposed change

• Dockerfile: css-build stage moves to node:24-alpine, digest-pinned.
• .github/dependabot.yml: ignore major updates for node, so the LTS line is chosen deliberately rather than proposed automatically.
• .github/dependabot.yml: ignore major updates for typescript. TS 7 removed the baseUrl compiler option that @docusaurus/tsconfig still sets, so it cannot be adopted until Docusaurus changes that (see chore(deps-dev): bump typescript from 6.0.3 to 7.0.2 in /website #746).

Patch and minor updates keep flowing for both.

Acceptance criteria

• Docker build succeeds through the css-build stage.
• All 11 required checks green.

Out of scope

• Changing how pnpm is installed. Corepack works on 24, so the existing approach stands until the LTS line drops it.