## Result

CI and publish jobs now request the newest available Node.js 24.x
release. This prevents GitHub-hosted runners from reusing an older
cached 24.x release.

## Changes

- `.github/workflows/ci.yml`: `node-version: "24"` without a freshness
check → `node-version: "24"` with `check-latest: true`
- `.github/workflows/e2e.yml`: `node-version: '24'` without a freshness
check → `node-version: '24'` with `check-latest: true`
- `.github/workflows/publish.yml`: three `node-version: "24"` steps
without a freshness check → the same three steps with `check-latest:
true`

The floating `node-version` values stay unchanged. No application code
changed.

## Security reason

Node.js 24.22.1 fixes the October 21, 2026 security release issues,
including CVE-2026-111497. Without `check-latest: true`,
`actions/setup-node` can use an older cached 24.x release, such as
24.21.0.

## Verification

- Confirmed that Node.js v24.22.1 exists in the official Node.js release
index and is marked as a security release.
- Confirmed that all five `actions/setup-node` steps with floating
Node.js 24 now set `check-latest: true`.
- `git diff --check` passed.
- [PR CI
passed](https://github.com/agentclientprotocol/codex-acp/actions/runs/39898084574).
Its `actions/setup-node` log says `Resolved as '24.22.1'`.
- The same CI run passed dependency installation, type checks, unit
tests, integration tests, and binary bundling.

The E2E and publish workflows do not run on pull requests. They run
after a push to `main` or through a manual dispatch. At the next E2E run
and release, check each `actions/setup-node` log for `Resolved as
'24.22.1'` or a newer 24.x release before using or publishing its
output.

## Risk and rollback

Risk is low. This changes only Node.js version resolution within the
existing 24.x release line.

Rollback: revert this PR. A rollback can allow a vulnerable cached
Node.js release again, so use it only for a short time.