[SandObserver]

Summary

• Read the published image's Node.js version with docker run --platform "$PLATFORM" --entrypoint node ... -p process.versions.node in the scheduled scan. The FROM scratch runtime stage has no NODE_VERSION, so the old Config.Env read passed an empty string and failed every run once the image was latest.
• Set up QEMU (same pinned action and binfmt image as the release workflow) for the arm64 run.
• Key the e2e system-package cache on the runner image and the resolved Playwright version, and drop its restore key. A partial hit installed an older package set and skipped --with-deps.
• Pin both in test/repo/release-workflow.test.js.

Testing
All green; the new version command returns 24.22.0 on the 1.19.0 image. Added 2 workflow tests.

Changelog

Checklist

• Stays within the project constraints: one container, no runtime dependencies, no build step (see CONTRIBUTING.md).
• Tests added or updated for new logic, and the full suite, lint, and typechecks pass.
• Docs updated if behavior or configuration changed.