ci: stop inheriting the runner's python and node

The runner executes jobs on the host rather than in a container, so a
workflow that says 'python3' or 'npm' is really saying 'whatever this
machine happens to have today'. Both of the test jobs added in c00a472
were red on the first run for exactly that reason.

uv venv with no --python takes the first interpreter it finds, which is
the host's 3.14 here. pyrogram's sync.py calls the bare
asyncio.get_event_loop() that 3.14 no longer auto-creates, so three
tests died at collection. Pinned to 3.13, which is both what uv will
fetch when the host has none and what python:3.13-slim actually builds.

npm was missing outright, and turned up an hour later as npm 12 on node
26 - the same push, minutes apart. Neither is the panel image's
node:22-alpine, so node is now installed from the official tarball the
way the other tools are, at the image's major. npm is checked by running
it rather than by looking it up, so a name that resolves to something
broken reads as not installed.

Renovate keeps NODE_VERSION in step with the Dockerfile's node: tag, and
the two are one grouped dependency: CI that tests on a different major
than it builds on is a gate that can pass over a real break.

.gitea/workflows/tool-versions.env

@@ -1,11 +1,11 @@
-# Pinned versions of the CI linters installed by install-ci-tools.sh.
+# Pinned versions of the CI tools installed by install-ci-tools.sh.
 # Renovate keeps these up to date (see customManagers in renovate/renovate.json).
 #
-# Every version below matches what was already installed on the runner, so
-# pinning them changes what CI does not at all. It changes what CI does when
-# the runner is rebuilt with something else: today install-ci-tools.sh finds
-# the pinned version already on PATH and installs nothing, and a runner that
-# drifts gets the pinned one installed over it.
+# Every version here except NODE_VERSION matches what was already installed on
+# the runner, so pinning them changes what CI does not at all. It changes what
+# CI does when the runner is rebuilt with something else: today
+# install-ci-tools.sh finds the pinned version already on PATH and installs
+# nothing, and a runner that drifts gets the pinned one installed over it.
 #
 # The renovate image version is NOT pinned here: renovate/k8s/cronjob.yaml is the
 # single source of truth and the workflows read the tag from it, so there is
@@ -24,3 +24,10 @@ PIP_AUDIT_VERSION="2.10.1"
 # uv builds the throwaway venv the pytest job runs in, and unpacks the PyPI
 # wheels for ruff, yamllint and pip-audit.
 UV_VERSION="0.12.17"
+# node runs `npm ci` for the frontend tests and the npm audit, and it is the one
+# pin here that does NOT come from the runner: the runner's system node is a
+# rolling Arch package (it was node 26 with no npm at all when this was pinned),
+# and the panel image is node:22-alpine. Pinned to the image's major on purpose,
+# so the tree that gets tested is the tree that gets built. Renovate keeps this
+# in step with the Dockerfile's node: tag via the "node runtime" group.
+NODE_VERSION="22.23.3"