ci: pin Node 24.x matrix to 24.18.0 (worker-teardown crash)

[kriscendobot]

Problem

test (24.x, ubuntu-latest) has been failing across unrelated PRs (e.g. #340, #877, #475) with one shared root cause — a CI-infrastructure issue, not a per-PR defect.

.github/workflows/ci.yml floats its Node matrix on 24.x. That float advanced from 24.18.0 → 24.19.0 mid-cycle. Node 24.19.0 regressed process teardown with a use-after-free in CleanupHookThunkRun, which crashes better-sqlite3@11.10.0 native workers as AVA tears down its worker threads:

/opt/hostedtoolcache/node/24.19.0/x64/bin/node[...]: void node::RemoveEnvironmentCleanupHook(...) at ../src/api/hooks.cc:142
Assertion failed: (env) != nullptr

Confirmed against the actual job logs: the red test (24.x, ubuntu-latest) run resolves node: v24.19.0; the last runs on 24.18.0 were green. (The regression is intermittent on 24.19.0 — some 24.19.0 runs pass — but 24.19.0 is what introduced it.)

Upstream:

• Use-after-free in CleanupHookThunkRun for every node::ObjectWrap alive at teardown nodejs/node#65195
• src: fix use-after-free in CleanupHookThunkRun nodejs/node#65196

Change

Pin the four 24.x matrix entries to 24.18.0 (last known-good) so the float stops, each with a comment citing the upstream issue. Lift the pin once the Node fix ships. This is the narrowest change that stops the float; the 22.x lane is untouched.

[kriscendobot]

Closing as superseded. The functional pin landed independently on llm as a59021f ("fix(ci): pin Node 24 matrix to 24.18.0", 2026-08-17T03:39:22Z), about 77 minutes before this PR was woven onto it. All four matrix jobs on llm now read node-version: [22.x, 24.18.0], identical to what this PR sets.

After the rebase this PR is comment-only: it would substitute a more detailed comment (use-after-free in CleanupHookThunkRun, referencing nodejs/node#65195 and nodejs/node#65196, plus an explicit condition for lifting the pin) for the landed one (which cites nodejs/node#65042). The landed comment names the same root cause and is accurate, so the remaining delta does not justify another review cycle.

The diagnosis this PR carried was verified against real CI logs: the red runs resolved node v24.19.0 and aborted AVA workers in RemoveEnvironmentCleanupHook while tearing down better-sqlite3 11.10.0. That evidence is preserved here and in the job record.

Note the pin is temporary on both accounts and should be lifted once a Node 24 patch carrying the upstream fix ships.