fix(ci): preinstall trusted Node and pnpm for coverage

[seonghobae]

문제

Naruon PR #1179의 exact-head 중앙 리뷰 실행(30429107789)에서 저장소가 고정한 pnpm@11.5.3이 coverage sandbox에 없어 coverage-evidence가 실패했습니다. 비신뢰 PR의 package-manager 코드를 네트워크 경계 밖에서 활성화할 수 없으므로, 중앙의 신뢰된 도구 이미지에 검증된 런타임을 포함합니다.

변경

• Node.js v24.18.0 공식 x64 tarball을 SHA-256 검증 후 설치
• pnpm 11.5.3 공식 npm tarball을 SHA-512 검증 후 설치
• Dockerfile 계약 테스트에 URL, digest, 설치 경로, 버전 검증 고정

검증

• Debian linux/amd64 컨테이너: node=v24.18.0 npm=11.16.0 pnpm=11.5.3
• 659 tests passed
• scripts/ci coverage: 5,599 statements, 100%
• docstring coverage: 100%
• Ruff passed
• actionlint workflow validation passed

[coderabbitai]

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 43 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 5546192b-4eb7-434b-bb0d-207a8037c0e0

📥 Commits

Reviewing files that changed from the base of the PR and between 17e7516 and 1be459f.

📒 Files selected for processing (2)

• .github/workflows/opencode-review-dispatch.yml
• tests/test_opencode_agent_contract.py

---

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Current-head governance audit

Audited exact head 1be459f762edb3e799058689e6508e55f5cc51de against base 17e7516124b97da88cd3b4e0216dfa79ebc14ed0.

• Local: 659 tests passed; scripts/ci 5,599/5,599 statements (100%); docstrings 100%; Ruff and actionlint passed.
• Linux amd64 reproduction: official SHA-verified Node v24.18.0, npm 11.16.0, and pnpm 11.5.3 all executed successfully.
• Default-branch dispatch 30430987586: exact metadata and merge tree validated; coverage-evidence passed and reported supported test suites plus configured docstring gates passed/advisory.
• PR checks: CodeQL actions/python, Bandit, pip-audit, OSV, dependency-review, trivy-fs, Semgrep, gitleaks, SBOM, Scorecard, and Strix all passed; PR code-scanning, Dependabot, and secret-scanning alert sets are empty.
• Review governance: zero review threads and zero review comments; mergeable state is MERGEABLE.
• Non-source external states: OpenCode model pool exhausted without a current-head control output, and CodeRabbit reported its organization review quota limit. The OpenCode workflow failed closed and posted no synthetic approval.

This PR repairs the trusted central review runner that blocked Naruon #1179 coverage. Because the required review providers cannot currently produce the approvals needed to merge their own infrastructure repair, the merge will use the documented narrow bootstrap procedure: exact-head guard, temporary suspension only of approval enforcement, immediate restoration, and post-merge verification.