feat(core): add Node 26, drop Node 20, bump to Alpine 3.24

[larowlan]

Adds Node 26 support, drops EOL Node 20, and aligns Alpine versions across streams.

• Install yarn explicitly before wrapping, as Node 26+ no longer ships it in the base image
• Latest builds: Node 22, 24, 26 on Alpine 3.24
• Stable builds: Node 22, 24 on Alpine 3.21 (Node 26 excluded until stable moves to 3.24)
• Bump Alpine default from 3.21 to 3.24 in docker-bake.hcl
• Add node_versions and alpine_version inputs to build-push.yml to allow per-stream configuration
• Replace Node 20 with Node 26 in the security scan matrix
• Bump all GitHub Actions to latest majors (checkout@v7, login-action@v4, setup-buildx-action@v4, bake-action@v7)

[larowlan]

Need to pass ALPINE_VERSION=3.24 for NODE_VERSION=26

[larowlan]

Looks like no yarn in the base image from 26 either

[kimpepper]

I can take a look