Node 24.22.1 macOS x64: checksum-matched archive and installer fail native signature verification #5178

Node.js version: 24.22.1 (artifact label; rejected executable was not run).
NPM version: Not executed; verification failed before runtime activation.
Operating system: macOS 14.8.7, build 23J520; x86_64.
Subsystem: Other — macOS release-artifact signatures.

The following official artifacts match their published SHA-256 checksums, but native Apple signature verification fails. Neither the new executable nor the installer has been executed or installed.

Archive: https://nodejs.org/dist/v24.22.1/node-v24.22.1-darwin-x64.tar.gz
SHA-256: d132557e7ee2b85af08b0c8c34338e65c6430f2238d01f727728ef42dc83b035
Extracted bin/node SHA-256: cc6f41f72e3eb4460154952e56a35afdd96b6995cea51cd25e637355a2955a51; matches the archive member.

Installer: https://nodejs.org/dist/v24.22.1/node-v24.22.1.pkg
SHA-256: ca7618402754944626787fca386c406a041541f097da172e92348d8b1e44e48b

Published checksum source: https://nodejs.org/dist/v24.22.1/SHASUMS256.txt.asc
Artifact and checksum downloads used verified HTTPS.

Verification commands and results (placeholders replace local paths):

codesign --verify --strict --verbose=4 <extracted-node>
<extracted-node>: invalid signature (code or signature have been modified)
In architecture: x86_64
Exit status: 1

codesign --verify --verbose=4 <extracted-node>
<extracted-node>: invalid signature (code or signature have been modified)
In architecture: x86_64
Exit status: 1

pkgutil --check-signature <installer>
Package "node-v24.22.1.pkg":
   Status: invalid signature
Exit status: 1

Successful controls on the same host: the Apple-provided ls executable and existing Node 24.18.0 and 24.20.0 executables pass native codesign verification. The embedded Node Foundation Developer ID certificate chain (team HX7739G8FX) passes native Apple code-signing certificate-chain verification including revocation checking. That chain result does not establish artifact-signature validity.

Can maintainers confirm verification of these exact artifacts and identify a supported remedy or corrected official artifacts? A matching checksum has not resolved the native signature failures.