fix(ci): pin container image with Node.js for act runner compatibility

The bezalel-vps-runner (act v0.2.11) fails in 1-6s because Node.js is
not in PATH of the default runner container, preventing any GitHub
Actions (actions/checkout, setup-uv, setup-node, etc.) from executing.

Add `container: catthehacker/ubuntu:act-22.04` to all workflow jobs.
This image is purpose-built for act runners and includes Node.js, git,
Python, npm, and other common CI tooling needed to run GitHub Actions.

Fixes #174

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.github/workflows/dependency-audit.yml

@@ -19,6 +19,7 @@ jobs:
   audit:
     name: Audit Python dependencies
     runs-on: ubuntu-latest
+    container: catthehacker/ubuntu:act-22.04
     steps:
       - uses: actions/checkout@v4
       - uses: astral-sh/setup-uv@v5

.github/workflows/docs-site-checks.yml

@@ -10,6 +10,7 @@ on:
 jobs:
   docs-site-checks:
     runs-on: ubuntu-latest
+    container: catthehacker/ubuntu:act-22.04
     steps:
       - uses: actions/checkout@v4
 

.github/workflows/quarterly-security-audit.yml

@@ -19,6 +19,7 @@ jobs:
   create-audit-issue:
     name: Create quarterly security audit issue
     runs-on: ubuntu-latest
+    container: catthehacker/ubuntu:act-22.04
     steps:
       - uses: actions/checkout@v4
 

.github/workflows/secret-scan.yml

@@ -12,6 +12,7 @@ jobs:
   scan:
     name: Scan for secrets
     runs-on: ubuntu-latest
+    container: catthehacker/ubuntu:act-22.04
     steps:
       - uses: actions/checkout@v4
         with:

.github/workflows/supply-chain-audit.yml

@@ -12,6 +12,7 @@ jobs:
   scan:
     name: Scan PR for supply chain risks
     runs-on: ubuntu-latest
+    container: catthehacker/ubuntu:act-22.04
     steps:
       - name: Checkout
         uses: actions/checkout@v4

.github/workflows/tests.yml

@@ -14,6 +14,7 @@ concurrency:
 jobs:
   test:
     runs-on: ubuntu-latest
+    container: catthehacker/ubuntu:act-22.04
     timeout-minutes: 10
     steps:
       - name: Checkout code