ci: stop inheriting the runner's python and node

The runner executes jobs on the host rather than in a container, so a
workflow that says 'python3' or 'npm' is really saying 'whatever this
machine happens to have today'. Both of the test jobs added in c00a472
were red on the first run for exactly that reason.

uv venv with no --python takes the first interpreter it finds, which is
the host's 3.14 here. pyrogram's sync.py calls the bare
asyncio.get_event_loop() that 3.14 no longer auto-creates, so three
tests died at collection. Pinned to 3.13, which is both what uv will
fetch when the host has none and what python:3.13-slim actually builds.

npm was missing outright, and turned up an hour later as npm 12 on node
26 - the same push, minutes apart. Neither is the panel image's
node:22-alpine, so node is now installed from the official tarball the
way the other tools are, at the image's major. npm is checked by running
it rather than by looking it up, so a name that resolves to something
broken reads as not installed.

Renovate keeps NODE_VERSION in step with the Dockerfile's node: tag, and
the two are one grouped dependency: CI that tests on a different major
than it builds on is a gate that can pass over a real break.

.gitea/workflows/install-ci-tools.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# Installs the pinned CI linters into "$TOOLS_DIR/bin" and echoes that directory
+# Installs the pinned CI tools into "$TOOLS_DIR/bin" and echoes that directory
 # on stdout, so callers can do:
 #
 #   export PATH="$(bash .gitea/workflows/install-ci-tools.sh kubeconform shellcheck):$PATH"
@@ -19,17 +19,20 @@ mkdir -p "$BIN_DIR"
 
 arch="$(uname -m)"
 # Upstream projects disagree on arch spelling: kubeconform and actionlint use
-# Go names (amd64/arm64), shellcheck uses uname names (x86_64/aarch64), and
-# hadolint mixes the two in a single release (x86_64 but arm64).
+# Go names (amd64/arm64), shellcheck uses uname names (x86_64/aarch64), node
+# uses neither (x64/arm64), and hadolint mixes the two in a single release
+# (x86_64 but arm64).
 case "$arch" in
   x86_64 | amd64)
     goarch=amd64
     sharch=x86_64
+    nodearch=x64
     hadolintarch=x86_64
     ;;
   aarch64 | arm64)
     goarch=arm64
     sharch=aarch64
+    nodearch=arm64
     hadolintarch=arm64
     ;;
   *)
@@ -164,6 +167,32 @@ install_prettier() {
   ln -sfn "prettier-${PRETTIER_VERSION}/package/bin/prettier.cjs" "$BIN_DIR/prettier"
 }
 
+install_node() {
+  # npm gets checked by running it, not by looking it up: what matters is that
+  # it answers, so a stub, a half-removed Arch package or a name that resolves
+  # to something broken all have to read as "not installed". The runner's npm
+  # is a symlink into /usr/lib/node_modules/npm, which is exactly the kind of
+  # thing that disappears between runs.
+  if at_version node "v${NODE_VERSION}" && [ -n "$(installed_version npm)" ]; then
+    return 0
+  fi
+  # Same shape as prettier above: the tarball's bin/npm and bin/npx are links
+  # into lib/node_modules, so the whole tree has to survive next to them.
+  local dir="$BIN_DIR/node-${NODE_VERSION}"
+  if [ ! -x "$dir/bin/node" ]; then
+    rm -rf "$dir"
+    mkdir -p "$dir"
+    fetch "https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-${nodearch}.tar.xz" \
+      "$dir/node.tar.xz"
+    tar -xJf "$dir/node.tar.xz" -C "$dir" --strip-components=1 "node-v${NODE_VERSION}-linux-${nodearch}"
+    rm -f "$dir/node.tar.xz"
+  fi
+  # Relative, so the whole tree stays valid if TOOLS_DIR is relocated.
+  for bin in node npm npx; do
+    ln -sfn "node-${NODE_VERSION}/bin/${bin}" "$BIN_DIR/${bin}"
+  done
+}
+
 install_actionlint() {
   if at_version actionlint "${ACTIONLINT_VERSION}"; then
     return 0
@@ -192,6 +221,7 @@ for tool in "${wanted[@]}"; do
     yamllint) install_yamllint ;;
     pip-audit) install_pip_audit ;;
     hadolint) install_hadolint ;;
+    node) install_node ;;
     uv) install_uv ;;
     *)
       echo "install-ci-tools: unknown tool: $tool" >&2