ci(MIC-95): upgrade Node container one major version at a time

[mtiller]

Result

Climbed the entire Node ladder, one major per commit. Landing on node:26 (Current) for both generate_site and deploy_site — most future-proof choice; works today and won't need revisiting when 26 becomes Active LTS in Oct 2026.

Climbing log

Commit	Container(s)	Result	Notes
Full Build label trigger	n/a	✅	Validates pull_request flow
generate_site → node:16	16	✅	baseline catch-up
generate_site → node:18	18	❌	OpenSSL 3 / Webpack 4 — error:0308010C:digital envelope routines::unsupported
+ NODE_OPTIONS=--openssl-legacy-provider	18	✅	remediation worked first try
generate_site → node:20	20	✅
generate_site → node:22	22	✅
generate_site → node:24	24	✅
Settle both on node:22	22 / 22	✅	(interim — see below)
Bump both to node:26	26 / 26	❌	node:26 image dropped bundled yarn
+ corepack enable attempt	26 / 26	❌	node:25+ dropped corepack too
+ npm install -g yarn	26 / 26	✅	final

What's in the diff that matters

1. generate_site container: node:14 → node:26
2. deploy_site container: node:18 → node:26 (alignment, same runtime everywhere)
3. npm install -g yarn step before make site — required because node:25+ images ship without yarn or corepack (corepack was deprecated in Node 25 and removed from the official image).
4. NODE_OPTIONS=--openssl-legacy-provider env var on make site (required for Webpack 4 on Node 17+ until book-nextgen upgrades its build chain).
5. pull_request trigger gated by Full Build label (the mechanism that let us iterate this PR end-to-end).

Future-proofing notes

• node:26 becomes Active LTS in October 2026 — by landing now we skip the next bump cycle entirely.
• The yarn-install workaround is a candidate to clean up when book-nextgen migrates off yarn 1.x classic.

Closes MIC-95.