fix: keep temporary Node binaries out of image layers

.github/workflows/release-readiness.yml

@@ -9,6 +9,7 @@ on:
       - 'docker/Dockerfile*'
       - 'shell/node-runtime-probe.cjs'
       - 'scripts/verify-panel-package.cjs'
+      - 'scripts/verify-image-node-layers.py'
       - 'test/back/node-runtime-probe.test.cjs'
   workflow_dispatch:
 
@@ -132,6 +133,28 @@ jobs:
           docker run --rm --network none --entrypoint node \
             qinglong-readiness:${{ matrix.image }} \
             -e 'const assert=require("node:assert/strict"); const {createRequire}=require("node:module"); for(const [name,want] of Object.entries({"@grpc/grpc-js":"1.14.5",compression:"1.8.2",multer:"2.4.0",sequelize:"6.37.8"}))assert.equal(require(name+"/package.json").version,want); const expressRequire=createRequire(require.resolve("express")); assert.equal(expressRequire("proxy-addr/package.json").version,"2.0.8"); const sockRequire=createRequire(require.resolve("sockjs")); assert.equal(sockRequire("websocket-driver/package.json").version,"0.7.5"); require("sqlite3"); require("nodemailer"); require("undici"); console.log("Minimal production patches and runtime imports verified")'
+      - name: Export ARMv6 image layers for Node regression checks
+        if: startsWith(matrix.image, 'alpine')
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          file: ${{ matrix.file }}
+          platforms: linux/arm/v6
+          build-args: |
+            QL_URL=${{ steps.source.outputs.url }}
+            QL_BRANCH=${{ steps.source.outputs.branch }}
+            SOURCE_COMMIT=${{ steps.source.outputs.sha }}
+          outputs: type=docker,dest=${{ runner.temp }}/node-layers-arm.tar
+          push: false
+          provenance: false
+          sbom: false
+      - name: Check Node binaries in every serialized image layer
+        if: startsWith(matrix.image, 'alpine')
+        run: |
+          docker save qinglong-readiness:${{ matrix.image }} -o "$RUNNER_TEMP/node-layers-amd64.tar"
+          python3 scripts/verify-image-node-layers.py "$RUNNER_TEMP/node-layers-amd64.tar" amd64
+          python3 scripts/verify-image-node-layers.py "$RUNNER_TEMP/node-layers-arm.tar" arm
+          rm "$RUNNER_TEMP/node-layers-amd64.tar" "$RUNNER_TEMP/node-layers-arm.tar"
       - name: Export native image for isolated dev validation
         if: matrix.image == 'debian' || matrix.image == 'alpine'
         run: |