fix(docker): enforce Node version alignment across build stages

scripts/check-node-toolchain.mjs

@@ -28,6 +28,23 @@ assert.equal(
 	"@types/node must match the pinned Node.js major",
 );
 
+const nodeImages = [
+	...readProjectFile("Dockerfile").matchAll(
+		/^FROM\s+(?:--platform=\S+\s+)?node:([^\s]+)\s*/gim,
+	),
+].map((match) => match[1]);
+assert.ok(
+	nodeImages.length > 0,
+	"Dockerfile must declare a pinned Node.js base image",
+);
+for (const image of nodeImages) {
+	assert.equal(
+		image,
+		`${pinnedVersion}-alpine`,
+		"every Docker Node.js stage must match .nvmrc",
+	);
+}
+
 if (!process.argv.includes("--static")) {
 	assert.equal(
 		process.versions.node,