Document the Node 26 LTS hold on the base-image bump

[mitchallen]

Dependabot PR #71 bumps the Dockerfile base image from 24-alpine to 26-alpine. It is being left open and unmerged until Node 26 actually enters LTS on 2026-10-28. This records that decision in CLAUDE.md so a future session doesn't merge it early or close it as stale.

Three changes to the Dependabot section:

• Tightened the "stay on LTS Node" rule. The old wording only described odd-numbered current releases (Node 25, declined in build(docker): bump node from 24-alpine to 25-alpine #60), which made an even major like 26 look like it already qualified. Reworded to the actual rule — a major counts once it has entered LTS, not when it is merely released — with a pointer to nodejs/Release/schedule.json so the dates get checked rather than assumed.
• New bullet marking build(docker): bump node from 24-alpine to 26-alpine #71 as parked, not stalled, with the unblock date and the note that its test and docker checks already pass, so the hold is purely calendar-based. Node 24 is in active LTS until 2026-10-20 and supported through 2028-04-30, so there's no urgency.
• Extended the "closing a Dependabot PR" bullet. The build(docker): bump node from 24-alpine to 25-alpine #60 prediction ("Node 26 LTS should still get a PR") came true as build(docker): bump node from 24-alpine to 26-alpine #71, and parking-open is now documented as the alternative to closing when it's a version we do eventually want.

Docs only — no source, build, or workflow changes.

🤖 Generated with Claude Code