build: make clean installs deterministic through Node 24

.github/workflows/ci.yml

@@ -6,15 +6,16 @@ on:
 jobs:
   test:
     runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        node-version: [20, 22, 24]
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
         with:
-          node-version: 22
+          node-version: ${{ matrix.node-version }}
           cache: npm
-      - run: npm ci
-      - run: npm test
-      - run: npm run check
-      - run: npm run build
-      - run: npm run smoke
+      - run: npx --yes npm@10.9.4 ci
+      - run: npx --yes npm@10.9.4 run release:check
       - run: bash scripts/validate.sh

.github/workflows/release-dry-run.yml

@@ -28,7 +28,7 @@ jobs:
           node-version: 22
           cache: npm
       - name: Install dependencies
-        run: npm ci
+        run: npx --yes npm@10.9.4 ci
       - name: Install ReleaseBox
         run: |
           set -euo pipefail
@@ -38,7 +38,7 @@ jobs:
       - name: ReleaseBox readiness check
         run: node /tmp/releasebox/bin/releasebox.js check .
       - name: Run release checks
-        run: npm run release:check
+        run: npx --yes npm@10.9.4 run release:check
       - name: Release notes preview
         run: |
           node /tmp/releasebox/bin/releasebox.js notes . > release-notes-preview.md

.github/workflows/release.yml

@@ -26,7 +26,7 @@ jobs:
           cache: npm
           registry-url: https://registry.npmjs.org
       - name: Install dependencies
-        run: npm ci
+        run: npx --yes npm@10.9.4 ci
       - name: Verify release tag matches package version
         run: node scripts/verify-release-tag.mjs
       - name: Install ReleaseBox
@@ -38,7 +38,7 @@ jobs:
       - name: ReleaseBox readiness check
         run: node /tmp/releasebox/bin/releasebox.js check .
       - name: Run release checks
-        run: npm run release:check
+        run: npx --yes npm@10.9.4 run release:check
       - name: Build package
         run: npm pack
       - name: Generate release notes

README.md

@@ -124,12 +124,13 @@ The matching recording outline is
 
 ## Verify
 
+Development supports Node.js 20, 22, and 24 with npm 10. The repository pins
+npm 10.9.4 so clean installs use the same lockfile implementation locally and
+in CI.
+
 ```sh
-npm install
-npm test
-npm run check
-npm run build
-npm run smoke
+npx --yes npm@10.9.4 ci
+npx --yes npm@10.9.4 run release:check
 bash scripts/validate.sh
 ```
 

docs/ORCHESTRATION.md

@@ -2,6 +2,6 @@
 
 Workstreams: product contract, core implementation, quality gates, and publishing setup.
 
-Verification gates: `npm install`, `npm test`, `npm run check`, `npm run build`, `npm run smoke`, `bash scripts/validate.sh`, and a real fixture-backed CLI smoke.
+Verification gates: `npx --yes npm@10.9.4 ci`, `npx --yes npm@10.9.4 run release:check`, `bash scripts/validate.sh`, and a real fixture-backed CLI smoke on supported Node.js 20, 22, and 24 runtimes.
 
 Release posture: usable MVP at `0.1.0`; publishing remains explicit and validation-first.

docs/orchestration.json

@@ -1 +1 @@
-{"project":"clipcase","source":"docs/PRD.md","status":"mvp-complete","commands":["init","new","add","list","show","search","export"],"storage":{"default":".clipcase","configFile":".clipcase.json","entryFormat":"markdown","indexFormat":"json"},"qualityGates":["npm install","npm test","npm run check","npm run build","npm run smoke","bash scripts/validate.sh"],"security":{"secretBlocking":true,"overrideFlag":"--allow-secret","networkRequired":false}}
+{"project":"clipcase","source":"docs/PRD.md","status":"mvp-complete","commands":["init","new","add","list","show","search","export"],"storage":{"default":".clipcase","configFile":".clipcase.json","entryFormat":"markdown","indexFormat":"json"},"qualityGates":["npx --yes npm@10.9.4 ci","npx --yes npm@10.9.4 run release:check","bash scripts/validate.sh"],"security":{"secretBlocking":true,"overrideFlag":"--allow-secret","networkRequired":false}}

package.json

@@ -42,12 +42,14 @@
   ],
   "author": "Roger Chappel",
   "license": "MIT",
+  "packageManager": "npm@10.9.4",
   "devDependencies": {
     "@types/node": "^25.0.0",
     "typescript": "^5.9.3"
   },
   "engines": {
-    "node": ">=20"
+    "node": ">=20 <25",
+    "npm": ">=10 <11"
   },
   "repository": {
     "type": "git",