[h0ffmann]

Parte do #83. O shell do site (.#site) estava no Node 24.21.0, afetado pela release de segurança de 2026-10-21. Ele recebe o Node do labs/gleam-website do picasso, e o h0ffmann/picasso#143 já fixou a 24.22.1 lá. Este PR traz esse picasso para cá.

• Picasso fixado: passa de b919f9e a 5da5237 (o merge do picasso#143) nos quatro lugares que o just pins exige iguais: flake.lock (gleam-website e code-graph), o submódulo forks/picasso, tools.lock e to-pdf.sh.
• Binários: os ptbr refeitos no rev novo (just tools-fetch) têm o mesmo sha256. Entre os dois revs, o labs/ptbr-tools não mudou, e o labs/ptbr-pdf só ganhou um osv-scanner.toml.
• Verificado: nix develop .#site -c node --version mostra v24.22.1, e just pins, just quality e just site passam.

O que fica aberto no #83

O nixos-unstable ainda está em 02c087f (2026-10-20), com nodejs 24.21.0. Quando o nixpkgs trouxer a 24.22.1 ou uma versão mais nova, faltam três passos:

1. nix flake update nixpkgs.
2. Apagar o nix/nodejs-bin.nix aqui e o labs/gleam-website/nodejs-bin.nix no picasso.
3. Voltar ao nodejs do nixpkgs.

Por isso este PR não fecha a issue.

---

Part of #83. The site shell (.#site) was on Node 24.21.0, affected by the 2026-10-21 security release. It gets its Node from picasso's labs/gleam-website, and h0ffmann/picasso#143 already pinned 24.22.1 there. This PR brings that picasso revision here.

• Picasso pin: moves from b919f9e to 5da5237 (picasso#143's merge) in the four places just pins requires to match: flake.lock (gleam-website and code-graph), the forks/picasso submodule, tools.lock and to-pdf.sh.
• Binaries: the ptbr binaries rebuilt at the new rev (just tools-fetch) have the same sha256. Between the two revs, labs/ptbr-tools did not change, and labs/ptbr-pdf only gained an osv-scanner.toml.
• Checked: nix develop .#site -c node --version prints v24.22.1, and just pins, just quality and just site pass.

Still open in #83: nixos-unstable is still at 02c087f (2026-10-20), with nodejs 24.21.0. Once nixpkgs ships 24.22.1 or newer, three steps remain:

1. nix flake update nixpkgs.
2. Delete nix/nodejs-bin.nix here and labs/gleam-website/nodejs-bin.nix in picasso.
3. Go back to nixpkgs' nodejs.

So this PR does not close the issue.

🤖 Generated with Claude Code