ci: use the runner image's node instead of setup-node, which downloaded it again on every run

.gitea/workflows/gates.yml

@@ -52,8 +52,8 @@ env:
   NODE_VERSION: "24.19.0"
   # The npm the cut runs and the npm CI runs must be one version: npm writes the
   # admin bundle whose bytes the release hashes are pinned to before CI ever
-  # rebuilds them. setup-node installs the npm that ships with the node above,
-  # so this pin is asserted, not installed.
+  # rebuilds them. The runner image ships the npm that comes with the node
+  # above, so this pin is asserted, not installed.
   NPM_VERSION: "11.17.0"
   # There is deliberately no CI_VERSION literal here. Ruling 2 allows the
   # version to exist in the tag and in build.zig.zon and nowhere else, and
@@ -126,20 +126,21 @@ jobs:
     # 1536Mi dind limit, and it runs no docker command — so it overlaps the
     # heavy runner's zig and image work instead of queueing behind it.
     runs-on: ubuntu-24.04-light
-    # The slowest green run took 4 minutes. A stalled Node download leaves setup-node
-    # holding an open socket after its retry succeeds, so the step never exits:
-    # without a limit the job held the runner for over an hour.
+    # The slowest green run took 4 minutes. Without a limit, a request stalled
+    # on the network once held the runner for over an hour.
     timeout-minutes: 8
 
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
-      - name: Set up Node
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+      # The runner image ships this Node and npm on PATH; the assertion below is
+      # what pins them. setup-node is not used: it looks for Node in an empty
+      # tool cache and downloads it again on every run.
+      - name: Cache npm downloads
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
-          node-version: ${{ env.NODE_VERSION }}
-          cache: npm
-          cache-dependency-path: admin/package-lock.json
+          path: ~/.npm
+          key: npm-${{ runner.os }}-${{ hashFiles('admin/package-lock.json') }}
 
       # The bundle is a release input whose hash is pinned before this run
       # exists, so a runner on a different node or npm must fail here rather

.gitea/workflows/release.yml

@@ -271,12 +271,14 @@ jobs:
           GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
         run: ./zig-out/bin/release resolve
 
-      - name: Set up Node
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+      # The runner image ships this Node and npm on PATH; the assertion below is
+      # what pins them. setup-node is not used: it looks for Node in an empty
+      # tool cache and downloads it again on every run.
+      - name: Cache npm downloads
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
-          node-version: ${{ env.NODE_VERSION }}
-          cache: npm
-          cache-dependency-path: admin/package-lock.json
+          path: ~/.npm
+          key: npm-${{ runner.os }}-${{ hashFiles('admin/package-lock.json') }}
 
       # The same pinned toolchain and normalized environment as the frontend
       # job in gates.yml: the cut pinned the bundle's bytes into flake.nix

.gitea/workflows/site.yml

@@ -26,7 +26,6 @@ concurrency:
   cancel-in-progress: false
 
 env:
-  NODE_VERSION: "24.19.0"
   # The newest wrangler older than npm's release-age floor on the day it was pinned.
   WRANGLER_VERSION: "4.148.0"
 
@@ -37,11 +36,8 @@ jobs:
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
-      - name: Set up Node
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
-        with:
-          node-version: ${{ env.NODE_VERSION }}
-
+      # Node is the one the runner image puts on PATH. setup-node is not used:
+      # it looks for Node in an empty tool cache and downloads it again.
       - name: Build
         working-directory: website
         run: |