ci: propose Node and pnpm toolchain pin verification

Hi! I checked the existing Python toolchain guard and the public references to PNI-280. I could not find an open public GitHub issue or Discussion for this work, so I wanted to confirm the intended scope before opening a PR.

Current state on `main`:

- `.node-version` declares Node 22.
- 14 of 15 `actions/setup-node` steps read `.node-version`; one existing step uses inline `node-version: "22"`.
- The explicit `pnpm/action-setup` versions agree with `package.json`; two setups already rely on its `packageManager` field.
- `CONTRIBUTING.md`'s counts appear to reflect an earlier repository snapshot. I traced that to later workflow additions, so I am treating it as normal drift rather than as a documentation defect in the original change.

Proposed small scope:

1. Add `scripts/release/verify-node-toolchain-pins.sh`, following the existing Python guard's deliberately small text-check approach.
2. Read the canonical Node version from `.node-version` and require every `actions/setup-node` step to use `node-version-file: ".node-version"` (including normalizing the one inline step).
3. Read the canonical pnpm version from `package.json` and require every explicit `pnpm/action-setup` pin to match it; omitted `version` remains valid where the action reads `packageManager`.
4. Run this in a read-only `node-toolchain-pins` workflow whenever a workflow, either canonical version source, or the verifier changes. The workflow itself would be included in the repository's existing actionlint scope.

Out of scope: changing the actual Node/pnpm versions, interpreting arbitrary YAML or shell, and correcting the documentation counts in this first PR.

I tested the baseline locally and also temporary Node and pnpm mismatches; each mismatch fails with the affected file and line. Does this match the intended PNI-280 direction? If so, I can submit the focused PR.