ci: align governance gates with local scripts and pin Node 24

[robsongajunior]

Summary

Fixes three open findings from the engineering audit (2026-07-26 re-check):

Pin Node (was: 17 × node-version: 'lts/*', no .nvmrc, no engines)

• .nvmrc = 24 — what lts/* resolves to today, so zero behavioral change; a future Node major becomes an explicit one-line PR instead of a silent CI bump.
• Root engines.node: ">=24".
• All workflow directives now use node-version-file: '.nvmrc' (checkout precedes setup-node in every workflow).

CI gate ≡ pnpm governance (was: CI re-implementing the checks with different flags; pnpm governance never ran in CI)

• Fixed the --ext .js,.js,.vue typo in webkit's lint/lint:fix — local lint now covers the 144 .ts files CI was already linting (prerequisite for aligning without weakening CI).
• Package-wide commands live where they belong: webkit's own format/format:check now cover the whole package (was src/ only; packages/webkit/.prettierignore mirrors the root ignores, incl. generated catalog.json) and the root webkit:format* scripts alias them. The root webkit:lint:style wrapper carries CI's package-wide stylelint glob.
• governance.yml's six raw steps (eslint, stylelint, prettier, vue-tsc, type-coverage, audit) now invoke the root npm scripts, and pnpm governance chains the same six legs — one command set, two entry points, no way to drift again.

Concurrency & workflow hygiene (was: no concurrency: in governance/deploy workflows)

• governance.yml: cancels superseded runs on the same PR (a new push obsoletes the old run's 8 Playwright-sharded jobs); pushes to main queue instead, so every landed commit keeps its own complete status.
• governance.yml triggers are now main-only — dev dropped, matching the repo's main-flow.
• app-storybook.yml / app-icons-gallery.yml: per-workflow groups with cancel-in-progress: false — an in-flight azion deploy is never killed mid-way; a queued run is replaced by the newest.
• Deleted app-storybook-dev.yml — the dev-branch storybook deploy is dead wiring now that the repo is main-flow.
• Swept the finding's loose ends, no change needed: auto-author-assign.yml is already least-privilege (issues: write, pull-requests: write) with a SHA-pinned action; deploy/OSSF workflows all carry permissions: {} + job-level grants.

Notes

• The gate alignment surfaced a latent violation CI had been silently passing: no-invalid-position-declaration fires on textarea.vue's deliberate, comment-documented inline style="width: 100%" (in-tree since feat: V4 sync release webkit/theme/icons #768, which also bumped stylelint to 17.14.0 — CI's identical stylelint step passes it on the same tree; false negative, mechanism unidentified). Since webkit bans <style> blocks in .vue files (zero exist), inline style attributes are the only CSS stylelint sees there, and bare declarations are the only valid content — the rule is disabled for **/*.vue via an override in .stylelintrc.json. The component is untouched.
• ci type → no release; no consumer-facing runtime change; no new dependencies.
• Verified locally: webkit:lint, webkit:lint:style, and webkit:format:check all pass — including a positive control (a misformatted probe outside src/ fails the check; dist/ and coverage/ stay ignored).