build: make clean installs deterministic through Node 24

[rogerchappel]

Summary

• pin the supported development toolchain to Node.js 20–24 and npm 10.9.4
• run clean installs and the complete release gate on Node 20, 22, and 24 in CI
• keep release workflows on the pinned lockfile implementation and document the executable install contract

Commits

• d19e301 build: pin supported install toolchain
• 2300cca ci: verify pinned installs through Node 24
• fda5f18 docs: define deterministic install contract

Verification

Each command ran from a clean dependency tree on Node.js 20.20.2, 22.23.2, and 24.19.0 with npm 10.9.4:

npm ci --ignore-scripts --no-audit --no-fund
npm run release:check
bash scripts/validate.sh

All three runtimes passed 23 tests, TypeScript checks/build, fixture-backed smoke, installed-package smoke, release-contract validation, and repository validation.

git diff --check origin/main...HEAD

Commit author and committer identities were verified exactly as Roger Chappel <miscanalysis@gmail.com>.

[rogerchappel]

Automated merge note

Triage class: auto-merge

Summary: Pins npm 10.9.4 and verifies deterministic clean installs across Node.js 20, 22, and 24 in CI, release workflows, package metadata, lockfile, and documentation (8 files, +24/-19).

Checks run: GitHub CI test (20), test (22), test (24), and release dry-run completed SUCCESS; worker-recorded clean installs and npm run release:check passed on Node 20/22/24 (23 tests, typecheck/build, smoke, installed-package smoke, release contract); bash scripts/validate.sh and git diff --check origin/main...HEAD passed; final diff and all commit identities reread.

Rebased/CI-repaired: No.

Verified head SHA: fda5f18647429a7d0f8394c37825cf060963b744.