[dbpolito]

Purpose

ARM images currently download an amd64-only dockerize binary, and version-only checks cannot detect that or broken package-manager defaults.

• Install dockerize v0.16.0 for the target Alpine architecture with pinned SHA-256 verification and fail on unsupported architectures.
• Move pnpm defaults into the config.yaml actually read by current pnpm; remove obsolete npm options. Hoisting is now explicitly project policy, as required by current pnpm. This supersedes the intent of fix: move pnpm settings out of .npmrc to silence npm 11 warnings #83 without its obsolete image layout or unread rc files.
• Keep templates and generated contexts synchronized; test helper execution, real npm/yarn/pnpm installs, config resolution and ownership as root and ASUSER=1000/1234 on both native CI architectures.
• Run tests on pull requests, including forks, and restrict push builds to master to avoid duplicate matrices. Retain manual/scheduled builds and explicitly exclude pull requests from publication.
• Build 24-nginx from the Node 24 parent just built and tested in the same job, isolate architecture caches, and validate nginx configuration (including the Alpine nginx user).

Final pull-request CI passed on native amd64 and arm64 for 22/24/26, including 24-nginx on both architectures. Local amd64 behavioral tests, nginx -t, generated-context checks, architecture-selection tests and actionlint also pass. Existing Node runtime tags are unchanged; Docker Hub login/push and manifest publication were skipped.