@tus/server: require patched Node releases for tooling (#895)

Maintainer builds used unsupported Node 20, while the release selector
could reuse a cached Node 24 runtime older than the [October security
fixes](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases).

Use `^22.23.4` for build/lint and `^24.22.1` for release tooling, with
`check-latest: true` for both. Retain the existing Node 20 secret-backed
test job as a compatibility check for the published support contract.
Consumers still need to update their own deployed Node runtime.

Validation: workflow YAML parsing, `git diff --check`, and council
review passed. Following this repository's instructions, build/lint and
integration qualification run in PR CI rather than local tests. The
release workflow has not been invoked.

[Build/lint
CI](https://github.com/tus/tus-node-server/actions/runs/39644417470)
passed on Node 22.23.4. [Secret-backed compatibility
tests](https://github.com/tus/tus-node-server/actions/runs/39644417824)
passed on the retained Node 20 lane. No Devin workflow or review was
present on this PR.

<sub>🤖 Claimed by [kvz](https://github.com/kvz) on
`framework1/tus-node-server` since 2026-10-21 · resume: `codex resume
01a15e32-a05f-7153-89c2-0b1273795a49`</sub>

Author: kvz

.github/workflows/ci.yml

@@ -33,7 +33,8 @@ jobs:
       - name: Install Node.js
         uses: actions/setup-node@v7
         with:
-          node-version: 20.x
+          node-version: '^22.23.4'
+          check-latest: true
           cache: npm
           cache-dependency-path: package-lock.json
 

.github/workflows/release.yml

@@ -23,7 +23,8 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v7
         with:
-          node-version: 24.x
+          node-version: '^24.22.1'
+          check-latest: true
 
       - name: Install dependencies
         run: npm ci --no-fund --no-audit

.github/workflows/tests.yml

@@ -49,6 +49,7 @@ jobs:
       - name: Install Node.js
         uses: actions/setup-node@v7
         with:
+          # Keep the published Node 20 compatibility check.
           node-version: 20.x
           cache: npm
           cache-dependency-path: package-lock.json