[jackharrhy]

Summary

• Use prebuilt Debian/glibc platformatic/node-caged:26-slim throughout the image.
• Rebuild native dependencies against the compression-enabled Node headers rather than accepting ordinary Node/V8 prebuilds.
• Verify Node 26/compression, SQLite reads/writes, bcrypt and sharp during image build; add PR coverage for isolated migrations and real home/events/companies requests.

Verified locally

• Full production image built successfully; runtime reports Node v26.12.1 and pointer compression 1.
• Actual SQLite, bcrypt and sharp checks pass.
• The proposed CI smoke job passed locally with a fresh disposable migrated database and the unchanged pnpm/tsx startup wrapper; /, /api/events and /api/companies return 200.
• Strict online jactionlint plus ShellCheck pass.

Production data/schema, package versions, startup wrapper, published image tags and existing deployment trigger are unchanged. Deployment is a separate staged fleet operation with the previous image retained for rollback.