[kvz]

Why: anonymous public ECR pulls hit toomanyrequests: Data limit exceeded before the Supabase Edge fixture can test either SDK package, including main CI attempt 2.

Use Supabase’s official GHCR mirror with the existing v1.76.2 tag and exact SHA-256 digest. Anonymous manifest reads confirmed byte-identical ECR/GHCR indices and the same ARM64/AMD64 images. The integration assertions, coverage and supported package runtimes remain intact.

Fixes #580.

Validation:

• corepack yarn verify:full on isolated, checksum-verified Node 26.12.1.
• corepack yarn test:sdk:edge: both packed @transloadit/node and transloadit bundled and ran successfully; no native dependencies, upload budgets and HMAC assertions passed.
• Council review: no issues found. No new source-text assertions were added for this registry-only change.
• PR CI: 14 passed, three expected skips. Merged main CI: 15 passed, two expected skips. Both runs passed the actual Edge fixture for both packed SDK packages.

_{🤖 Claimed by kvz on studio1/node-sdk since 2026-10-22 · resume: codex resume 01a1622a-0fd4-7530-bbcd-ebb3b2800703}