[uk-ai-resilience] Untracked missing node-version pin in format-and-commit.yml (alert #831, Tier B)

### Summary

CodeQL alert #831 (`pr-action.rules.github-actions.javascript-lockfile-install.github-actions-setup-node-missing-version`, severity: error) flags `.github/workflows/format-and-commit.yml:29`, where `actions/setup-node` is used without an explicit `node-version` (or `node-version-file`) input:

```yaml
- name: Set up Node.js
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
with:
cache: npm
cache-dependency-path: pkg/workflow/js/package-lock.json
```

This alert was introduced/surfaced by PR #61359 ("Fix stale docker action pins in wasm golden fixture", merged 2026-09-16), which touched this workflow while re-pinning stale Docker action SHAs. It has no matching open tracking issue, breaking the classification → control-verification loop for this run's recent-changes scope (7-day lookback since 2026-09-09T15:31:12Z).

### Tier & risk-scoring

- **Tier: B — Open With Conditions**
- Exposure amplification: Low–Medium — without a pinned Node version, the workflow silently picks up whatever default/latest Node version the action resolves to, which can drift across runs and diverge from the version used locally/in other CI jobs.
- Patchability: High — trivial fix, add an explicit `node-version` (or `node-version-file: .nvmrc`/`package.json engines`) input.
- Detectability: Medium — only surfaces as flaky/inconsistent behavior if a Node version bump changes tool behavior; no active monitoring for version drift today.
- Operational fragility: Medium.
- Ownership confidence: High — single workflow file, clear scope, no cross-cutting change needed.

### Remediation action

- Add an explicit `node-version` (or `node-version-file`) input to the `actions/setup-node` step in `.github/workflows/format-and-commit.yml:29`, matching the Node version used elsewhere in the repo's CI/build tooling.
- **SLA urgency: Medium**

### Reference

Full governance analysis: see the linked discussion report `#aw_ukgov0916`.

> Generated by [UK AI Operational Resilience](https://github.com/github/gh-aw/actions/runs/35115690786) · copilot · auto · 94.4 AIC · ⌖ 7.9 AIC · ⊞ 8.2K · [◷](https://github.com/search?q=repo%3Agithub%2Fgh-aw+is%3Aissue+%22gh-aw-workflow-call-id%3A+github%2Fgh-aw%2Fuk-ai-operational-resilience%22&type=issues)

Open .github/workflows/format-and-commit.yml at the setup-node step around line 29, then inspect the repository's other CI/build tooling to identify the intended Node version. Add the explicit version input and verify the workflow configuration and formatting job still run successfully.

Written by the indexing model from the issue text.