runtime: single source of truth for embedded Node path/version

[benvinegar]

Problem

The embedded Node path/version (node-v22.14.0-linux-x64) is hardcoded in many scripts and docs. Upgrading Node requires touching many files and is easy to do inconsistently.

Proposed solution

• Introduce one canonical runtime Node locator/version source (e.g., shared helper + env override).
• Update scripts/services/docs to consume that source rather than embedding literal versioned paths.
• Add a validation check (doctor/test) that fails if Node path references drift.
• Keep backward-compatible fallback detection for existing installs.

Helpful context

Current duplication appears in:

• start.sh PATH setup and tmux bridge command
• bin/doctor.sh (NODE_BIN, PI_BIN)
• bin/security-audit.sh node binary checks
• bin/baudbot node resolution candidates
• bin/baudbot.service PATH environment
• bin/ci/setup-ubuntu.sh, bin/ci/setup-arch.sh
• docs/config examples (README.md, docs/operations.md, CONFIGURATION.md)

Related constants nearby: BAUDBOT_PI_VERSION default in setup.sh.