ci(actions): harden hosted-runner resilience

[jsugg]

Summary

• harden local Edge startup and bound idempotent Java navigation
• move CI Docker startup into a tested retry/readiness helper
• reduce nightly registry bursts with jitter and matrix concurrency limits
• upgrade Node/Python setup and artifact actions to supported runtimes
• align Dependabot commit scopes and CI-guide policy

Root cause addressed

Nightly run 30190689132 failed before checkout when one hosted runner exhausted
Docker Hub pull retries for the pinned application image. Job-level service
containers start before workflow steps, so the repository could neither tune
retries nor emit useful diagnostics.

Resilience design

• four bounded image-pull attempts with exponential backoff and jitter
• digest validation and --pull=never container startup
• explicit website and Selenium Grid readiness checks
• grouped diagnostics and cleanup on startup failure
• no retries around assertions or state-changing test actions
• at most three concurrent legs per nightly matrix

Hosted validation

PR checks and a branch-scoped nightly dispatch will be required before merge.

[jsugg]

Hosted validation is complete: the full 20-job nightly matrix passed on this branch, including Java local Edge and Java Grid Firefox—the two previously observed failure paths. Run: https://github.com/jsugg/the-internet-tests/actions/runs/30415496399