[ralph-bitgo]

What

• Pin the remaining floating Node selectors in this repo's workflows to 22.23.4: .github/workflows/audit-api-spec.yaml (x2) and .github/workflows/release-to-ghcr.yaml (x2) — node-version: 22/'22' → '22.23.4'.
• The rest of WCN-3707 (image base + digest pins in Dockerfile and integration-tests.Dockerfile, ENV NODE_VERSION, .nvmrc, README floor, pull_request.yaml and build-and-test.yaml selectors) already landed on master via fix(docker): upgrade node runtime to 22.23.4 #291 and docs(docker): update README node prerequisite to 22.23.4 #292. This PR covers only the residual CI alignment from ticket step 6; scope was reduced after those merges landed mid-session.

Why

• WCN-3707 requires every Node version selector in this service's own files to be aligned to 22.23.4, the supported floor for the 22 line containing the October 2026 Node.js security fixes. Floating 22 selectors resolve to whatever latest 22.x the runner serves and can drift ahead of the pinned image/.nvmrc runtime; pinning keeps audit and release jobs on the exact validated runtime and consistent with the repo's supply-chain pinning pattern.

WCN-3707 runtime verification (state now on master)

• Digest verified with the ticket's documented procedure: docker pull --platform linux/amd64 node:22.23.4-alpine → Digest: sha256:ce8d97f7cfc7c5386421eb932df20a29df99b1a7f469f6157d5c9956702ffadc; docker inspect --format='{{index .RepoDigests 0}}' → node@sha256:ce8d97f7cfc7c5386421eb932df20a29df99b1a7f469f6157d5c9956702ffadc. This matches the digest pinned in Dockerfile (builder + production) and integration-tests.Dockerfile (builder + runner) on master.
• docker run --rm node:22.23.4-alpine node -v → v22.23.4. .nvmrc contains 22.23.4. ENV NODE_VERSION=22.23.4 in the builder stage. grep -n "node:" Dockerfile integration-tests.Dockerfile shows only node:22.23.4-alpine with that digest; no stale 22.14.0/22.1.0 references remain in the service's files.

Deployment usage of the recipe

• Confirmed from repo evidence: .github/workflows/release-to-ghcr.yaml builds Dockerfile and pushes ghcr.io/bitgo/advanced-wallets:<version> and :latest; .github/workflows/pull_request.yaml grants packages: read annotated "required for ArgoCD deploy", i.e. ArgoCD deploys the GHCR image built from this recipe.
• Not establishable from repo evidence: the currently running deployed version (no deploy manifests in this repo; docker-compose*.yml are local dev only). Rollout child WCN-3713 records the actually deployed Node version and rollback criteria.

Test plan

• node-version selectors in .github/workflows all resolve to 22.23.4 (or the inputs.node-version default, already 22.23.4)
• YAML unchanged apart from the four selector lines
• CI on this PR (workflow syntax exercised by GitHub on push)

Ticket: WCN-3707

[linear-code]

WCN-3707