picofuzz/Dockerfile: align Node.js version with CI (24 vs 25) and add non-root USER

## Summary

The `picofuzz/Dockerfile` currently uses `node:25-alpine` as its base image, while all CI workflows standardise on **Node.js 24** (verified across `.github/workflows/*.yml` files and `@tsconfig/node24` TypeScript config). This version split weakens test fidelity because code certified on Node 24 in CI may behave differently in the container running Node 25.

Additionally, the Dockerfile has no `USER` directive, which means the container runs as **root** — a security concern flagged by Trivy (rule DS-0002).

## Issues

1. **Node.js version mismatch** — Dockerfile pins `node:25-alpine`; CI uses Node 24.
2. **Container runs as root** — No `USER` directive / non-root user defined.

## Suggested remediation

- Change `FROM node:25-alpine` → `FROM node:24-alpine` (or bump the entire codebase to 25 consistently).
- Add a dedicated non-root user and a `USER` instruction to the Dockerfile.

## References

- PR: https://github.com/FluffyLabs/typeberry-testing/pull/100
- Review comment: https://github.com/FluffyLabs/typeberry-testing/pull/100#discussion_r2895756887
- Raised by: @tomusdrw