Harden CI and local fixture tests

[elanthus]

Summary

• test supported Node 22 and 24 releases in CI, add Firefox coverage, pin Actions by reviewed SHA, and set read-only workflow permissions
• run the owned test suite before the non-blocking external Heroku suite and add weekly dependency automation
• bind the fixture server to 127.0.0.1, validate URL and port configuration, and add fast negative server tests
• narrow the accessibility language to the open-menu state that is actually scanned
• include the pre-existing esbuild and ESLint dependency updates in the verified package and lockfile state

Verification

• npm run lint
• npm run test:unit — 5 passed
• npm run test:react — 3 passed in Chrome
• Firefox local suite — 3 passed

CI will repeat the owned suite on Node 22/24 with Chrome and on Node 24 with Firefox.

Preflight review

No findings were reported. All 23 delivered review units were marked examined clean; package-lock.json was excluded as generated dependency metadata.

This preflight record proves what the gate reported and provides an audit trail; it does not prove review understanding or replace CI and human review. This PR uses manual-merge approval and does not enable auto-merge.