task: #3635498 Update Node.js to >= 24.0 and Yarn to 4.18.1

Moves the Node.js pins on 10.1.x to 24, the floor Drupal core main declares in core/package.json. Node.js 20 reached end of life on 30 April 2026.

Issue: https://www.drupal.org/i/3635498

• package.json: engines "node": ">= 24.0" and "yarn": ">= 4.18.1", packageManager yarn@4.18.1, with the Varbase .yarnrc.yml.
• Dependency ranges use carets, ^MAJOR.MINOR.PATCH, as Drupal core's package.json does. No major changes. fork-ts-checker-webpack-plugin was ~8 || ~9 and is now ^9.0.0.
• CI: .gitlab-ci-local.yml image node:24; .gitlab-ci.yml image node:24, NodeSource setup_24.x.
• DDEV: .ddev/config.yaml nodejs_version: "24".
• Upsun: not present.
• Also on Node 24: .lando.yml, tests/README.md, tests/scripts/install-varbase-testing.sh.
• Lockfiles are no longer committed: none was tracked, and .gitignore now ignores them.

With no lockfile on Node v24.22.2 and Yarn 4.18.1, CI=true YARN_ENABLE_IMMUTABLE_INSTALLS=false yarn install resolves and links 1028 packages, and the Cucumber dry-run passes (185 scenarios). The postinstall needs a Composer-built docroot, as before, which is why the lint jobs install with --mode=skip-build. The CI build cache now keeps vendor, node_modules, docroot and bin per pipeline only: ScriptHandler::removeGitDirectories strips the .git of -dev source installs, so a later pipeline could not update them. MR pipeline 1033362 starts from a clean tree, and composer still fails only on the drupal/shield patch.

• e2e: tests/features/varbase/09-admin-preview-and-uploads/03-08-access-media-bulk-upload-permissions.feature matches Media Bulk Upload 3.0.6. The form title is now "Media bulk upload" (3.0.5 hard-coded "Multiple upload"), and the form now also needs permission to create media of a type it handles, so the SEO admin role, which has the bulk upload permission but no create media permission, is refused. Whether the SEO admin should create media is a Varbase Media decision.

The shield patch that stopped composer is gone from varbase-patches (Vardot/varbase-patches#691, merged). MR pipeline 1034596 is green: every job, PHPStan and PHPCS included.

AI-Generated: Yes

Checkpoints:

• File an issue
• Addition/Change/Update/Fix
• Testing to ensure no regression
• Automated unit testing coverage
• Automated functional testing coverage
• UX/UI designer responsibilities
• Readability
• Accessibility
• Performance
• Security
• Developer Documentation
• User Guide Documentation
• Reviewed by human
• Code review by maintainers
• Full testing and approval
• Credit contributors
• Review with the product owner
• Release notes snippet
• Release