Set up pinned Node in Rust CI jobs and drop unused tsjs deps

[dhruv8sh]

Summary

• Every Rust build is also a Node build: trusted-server-core depends on trusted-server-js, whose build script runs npm ci / npm run build with the npm on PATH and embeds the bundles. Most Rust CI jobs never set up the .tool-versions Node, so they built those bundles with the runner image's Node (22 on ubuntu-24.04) instead of the pinned 24.12.0. They would also have missed the planned pin bump (Upgrade to Rust 1.98.1 and align dependencies with EdgeZero #1123).
• Set up the pinned Node, with npm caching, before the first cargo command in every remaining Rust job and in the shared integration-test composite action.
• Drop the unused direct trusted-server-js dependency from the Cloudflare and Spin adapters, as Remove unused dependencies and disable unnecessary test targets #614 did for Fastly. Both still get it through core.

Changes

File	Change
.github/workflows/test.yml	Add setup-node (node-version-file: .tool-versions, cache: npm) before cargo in test-cloudflare, test-spin, test-parity
.github/workflows/format.yml	Same step before cargo fmt / clippy in format-rust
.github/actions/setup-integration-test-env/action.yml	Install the resolved Node right after reading it, before the Fastly/Axum/Cloudflare builds. Covers prepare-artifacts, integration-tests-fastly-ec, browser-tests
.github/workflows/integration-tests.yml	Remove the integration-tests job's setup-node step, now done by the composite action
crates/trusted-server-adapter-cloudflare/Cargo.toml	Remove unused trusted-server-js dependency
crates/trusted-server-adapter-spin/Cargo.toml	Remove unused trusted-server-js dependency
Cargo.lock	Drop the two dependency edges

Notes:

• Since the issue was written, main already set up Node before cargo in test-axum and test-cli, so those jobs are unchanged.
• browser-tests keeps its own setup-node step for its two-lockfile npm cache.
• Out of scope: skipping the unused Axum build in integration-tests-fastly-ec / browser-tests, and enforcing the Node version locally (engines field or a build.rs check).

Closes

Closes #1204

Test plan

• cargo test-fastly && cargo test-axum
• cargo clippy-fastly && cargo clippy-axum
• cargo fmt --all -- --check
• JS tests: cd crates/trusted-server-js/lib && npx vitest run
• JS format: cd crates/trusted-server-js/lib && npm run format
• Docs format: cd docs && npm run format
• WASM build: cargo build --package trusted-server-adapter-fastly --release --target wasm32-wasip1
• Manual testing via fastly compute serve
• Other: cargo check-cloudflare, cargo check-spin, cargo test-cloudflare, cargo test-spin, and clippy for Cloudflare (native + wasm) and Spin (native + wasm). A script also checked that every job's setup-node step comes before its first cargo step that compiles core.

Vitest passes 1185/1185 under the pinned Node 24.12.0. Under Node 26, 27 Permutive/Sourcepoint tests fail because Node 26's built-in localStorage hides jsdom's. That is local version drift, not caused by this PR. To confirm the CI change, check that each touched job's setup step shows the .tool-versions Node.

Checklist

• Changes follow AGENTS.md conventions
• No unwrap() in production code — use expect("should ...") (no Rust code changed)
• Uses tracing macros (not println!) (no Rust code changed)
• New code has tests (CI config and manifest changes only; checked by the CI run itself)
• No secrets or credentials committed

[ChristianPavilonis]

Review summary

Reviewed 2b1914286d53d01a768850c237b7274865b24037 against 7a0ecb4cbfa39af3d83f7e1ed2733d7eabdc4cb1. All seven changed files were inspected, including CI callers and the adapter-to-core-to-JS dependency and serving paths. No actionable issues introduced by this PR were found.

Safety proof

• Logs from all eight affected CI jobs confirmed Node v24.12.0 before their first TSJS build. Wrangler installation and the browser job's separate two-lockfile cache also succeeded.
• Locked, offline dependency checks confirmed both adapters retain JS through core on native and production WASM targets. Full manifest and lockfile comparison found only the two intended dependency-edge removals.

Validation and review context

• Local cargo fmt --all -- --check, diff whitespace checks, actionlint with ShellCheck, locked/offline Cargo metadata and dependency-tree checks, and in-memory manifest, lockfile, consumer, and CI-log assertions passed.
• All reported PR checks passed. Inspected logs confirmed 1,185 JS tests, native adapter tests, production-target compilation, parity, integration, and browser tests passed. CI merge commit 0002055156cf3acb3eaa604fc045ced11f0adb7c has the same tree as the reviewed head.
• Existing reviews, inline comments, issue comments, and review threads contained no feedback.
• Manual deployment was not exercised. Build and runtime evidence was reused from verified same-tree CI rather than rerun locally. Review performed without delegation or file edits; worktree remained clean.