Enforce the pinned Node version for local and deploy builds of trusted-server-js #1266

Description

#1204 / #1257 pin Node for CI only. No workflow builds the deployed artifacts: fastly compute publish, spin build and wrangler deploy all run the cargo build on the operator's machine, and crates/trusted-server-js/build.rs runs npm ci / npm run build with whatever npm is on PATH, with no version check. crates/trusted-server-js/lib/package.json has no engines field and there is no .nvmrc, so deployed bundles can be built with any Node version.

Local drift already happens: under Node 26, 27 Permutive/Sourcepoint Vitest tests fail because Node's built-in localStorage hides jsdom's, while the pinned 24.12.0 passes.

Options:

• Add engines.node to lib/package.json together with engine-strict=true in lib/.npmrc.
• Have build.rs compare node --version with the nodejs entry in .tool-versions and warn or fail on a mismatch (with an escape hatch for intentional overrides).

Raised in review of #1257: #1257 (comment)

Done when

• A local or deploy build with a Node version other than the .tool-versions pin warns or fails with clear instructions.
• The pinned version is defined in one place (.tool-versions) and the check reads it from there.
• CI keeps passing with the pinned Node, and the escape hatch (if any) is documented.

Affected area

JS build pipeline