Lock the indexer image and close the advisories in the build tooling

The indexer image installed @subql/node and the @polkadot -> @pezkuwi aliases
with an unlocked npm install, and the build cache kept the layer from the day
it was first built: the indexers ran @pezkuwi/wasm-crypto 7.5.17/7.5.18, the
build whose ed25519 and secp256k1 are stubs, plus vm2 3.9.19 (the mapping
sandbox, 54 advisories). No lockfile meant Dependabot never saw that tree.

- docker/indexer holds the image's package.json and package-lock.json:
  @subql/node 6.4.6 as today, @pezkuwi 16.5.39 / 14.0.26 / 7.5.21, overrides
  for vm2 3.12.2, uuid 11 and package-json 7 (got 11). The Dockerfile runs
  npm ci on Node 24 (Node 20 is out of support).
- The pruned-state patch stops the build when a pattern matches nothing,
  instead of reporting success with the fallback missing.
- CI builds the indexer image and runs the crypto smoke test inside it
  through the @polkadot aliases, the way subql-node loads them.
- The root yarn.lock, which the host installs as root on every deploy to run
  subql codegen/build, moves the advisory ranges forward with targeted
  resolutions and @pezkuwi/braces. Left: elliptic (low, via ethers 5 in
  @subql/cli) and sprintf-js (moderate, via jest's argparse 1); neither has
  a fixed release.

docker/Dockerfile.node

@@ -1,31 +1,13 @@
-FROM node:20-alpine
+FROM node:24-alpine
 
 WORKDIR /app
 
-# Install @subql/node with @polkadot aliased to @pezkuwi
-RUN npm init -y && \
-    npm install @subql/node \
-    @polkadot/api@npm:@pezkuwi/api@^16.5.36 \
-    @polkadot/api-augment@npm:@pezkuwi/api-augment@^16.5.36 \
-    @polkadot/api-derive@npm:@pezkuwi/api-derive@^16.5.36 \
-    @polkadot/types@npm:@pezkuwi/types@^16.5.36 \
-    @polkadot/types-augment@npm:@pezkuwi/types-augment@^16.5.36 \
-    @polkadot/types-codec@npm:@pezkuwi/types-codec@^16.5.36 \
-    @polkadot/types-create@npm:@pezkuwi/types-create@^16.5.36 \
-    @polkadot/types-known@npm:@pezkuwi/types-known@^16.5.36 \
-    @polkadot/rpc-core@npm:@pezkuwi/rpc-core@^16.5.36 \
-    @polkadot/rpc-provider@npm:@pezkuwi/rpc-provider@^16.5.36 \
-    @polkadot/rpc-augment@npm:@pezkuwi/rpc-augment@^16.5.36 \
-    @polkadot/util@npm:@pezkuwi/util@^14.0.25 \
-    @polkadot/util-crypto@npm:@pezkuwi/util-crypto@^14.0.25 \
-    @polkadot/keyring@npm:@pezkuwi/keyring@^14.0.25 \
-    @polkadot/networks@npm:@pezkuwi/networks@^14.0.25 \
-    @polkadot/wasm-crypto@npm:@pezkuwi/wasm-crypto@^7.5.18 \
-    @polkadot/wasm-crypto-wasm@npm:@pezkuwi/wasm-crypto-wasm@^7.5.17 \
-    @polkadot/wasm-util@npm:@pezkuwi/wasm-util@^7.5.17 \
-    @polkadot/wasm-bridge@npm:@pezkuwi/wasm-bridge@^7.5.17 \
-    @polkadot/wasm-crypto-asmjs@npm:@pezkuwi/wasm-crypto-asmjs@^7.5.17 \
-    @polkadot/wasm-crypto-init@npm:@pezkuwi/wasm-crypto-init@^7.5.17
+# @subql/node with @polkadot aliased to @pezkuwi. The tree is locked in
+# docker/indexer so every build installs the same packages (and Dependabot
+# can see them); without the lock a cached layer kept whatever was current
+# the day it was first built.
+COPY docker/indexer/package.json docker/indexer/package-lock.json ./
+RUN npm ci --no-audit --no-fund
 
 # @subql/node requires '@polkadot/api-augment/substrate' but @pezkuwi uses
 # chain-specific paths (./pezkuwi, ./bizinikiwi). Patch the exports map in