fix(ci): accept any runtime the engines range supports

The active-runtime assertion required process.versions.node to equal
.nvmrc exactly, so any Node.js patch release broke `toolchain:check` and
the act CI run even though package.json engines (>=26.10.0 <27) supports
the newer runtime.

Keep .nvmrc and the Docker base image exactly pinned for reproducibility
(both still asserted), but validate the running runtime against the
engines range instead. Verified: toolchain:check, lint, typecheck,
i18n:check, hk:matrix:check and all 3391 tests pass.

scripts/check-node-toolchain.mjs

@@ -45,11 +45,28 @@ for (const image of nodeImages) {
 	);
 }
 
+const cmpVersion = (a, b) => {
+	const pa = a.split(".").map((part) => Number.parseInt(part, 10));
+	const pb = b.split(".").map((part) => Number.parseInt(part, 10));
+	for (let i = 0; i < Math.max(pa.length, pb.length); i++) {
+		const diff = (pa[i] ?? 0) - (pb[i] ?? 0);
+		if (diff !== 0) return diff;
+	}
+	return 0;
+};
+
+// `.nvmrc` is the recommended version for reproducible local development and
+// the exact Docker base image (both asserted above), but the *runtime* we run
+// on may be any version the package.json engines range accepts. Requiring an
+// exact patch match here would fail on every Node.js patch release, even when
+// the version is explicitly supported.
 if (!process.argv.includes("--static")) {
-	assert.equal(
-		process.versions.node,
-		pinnedVersion,
-		"the active Node.js runtime must match .nvmrc",
+	const active = process.versions.node;
+	const upperBound = `${major + 1}.0.0`;
+	assert.ok(
+		cmpVersion(active, pinnedVersion) >= 0 &&
+			cmpVersion(active, upperBound) < 0,
+		`the active Node.js runtime (${active}) must satisfy package.json engines.node (${packageJson.engines.node}); .nvmrc pins ${pinnedVersion} as the recommended version`,
 	);
 }