chore(ci): modernize Node matrix — drop EOL versions, target Active LTS + Current - #17

…TS + Current

Sprint 175 PR #16 CI dogfood surfaced 230+ test failures across the entire
matrix. Root cause was not Sprint 175 work — it was systemic CI rot.

## Why now

| Node | Status (May 2026) | We were testing? |
|------|---------------------|---------------------|
| v18 (Hydrogen) | EOL Apr 2025 — 1+ year dead | ❌ Yes (wasted) |
| v20 (Iron) | EOL Mar 2026 — 2 months dead | ❌ Yes (wasted) |
| v22 (Jod) | Maintenance EOL May 2026 — this month | ❌ Yes (wasted) |
| **v24 (Krypton)** | **Active LTS (until May 2027) — production target** | ❌ NO (untested) |
| v26 | Current (latest) | ❌ NO (untested) |

The matrix burned three slots on dead-or-dying releases while never
touching Active LTS or Current. better-sqlite3 v12.10.0 (released May 12,
2026) explicitly removed Node 20/23 prebuilds and added Node 26 — so the
old matrix was guaranteed to fail post-12.10.0 anyway.

## Changes

- All 7 workflows (`ci.yml`, `dashboard-build.yml`, `cross-platform-e2e.yml`,
  `docs.yml`, `publish.yml`, `release.yml`, `secret-scan.yml`):
  - Matrix `[18.x, 20.x, 22.x]` → `[24.x, 26.x]` (test-core, test-orchestra,
    test-cli, test-remaining, dashboard build)
  - Fixed `'22.x'` / `'20'` → `'24.x'` / `'24'` (typecheck, security,
    test-docs-scripts, test-dashboard, test-windows, coverage, build,
    docs, publish, release, secret-scan, cross-platform-e2e)
  - Dashboard artifact upload condition: `matrix.node-version == '22.x'`
    → `'24.x'` so the LTS run ships the artifact.

- `package.json`:
  - `engines.node`: `>=18.0.0` → `>=24.0.0`. Breaking-change-by-design for
    OSS GA — Node 18/20/22 users get a clear error instead of a runtime
    crash later (npm shows `engineStrict` warning at install time).
  - `better-sqlite3`: `^12.9.0` → `^12.10.0` (Node 26 prebuilds, Node 20/23
    cleanup). Verified locally: 12.10.0 ships prebuilds for the new
    matrix; no native compile required at install time.
  - New script `ci:rebuild-native: npm rebuild better-sqlite3 --ignore-
    scripts=false`. Required because `.npmrc` sets `ignore-scripts=true`
    (Sprint 167 H3 supply-chain hardening); `npm ci` honours that and
    skips better-sqlite3's `prebuild-install || node-gyp rebuild`, so
    the native binding never lands without an explicit rebuild step.
    Targeted to the one package that needs it — the .npmrc guard for
    every other dependency stays intact.

- All 7 workflows: new step `npm run ci:rebuild-native` after `npm ci`.
  Five-second cost per job; without it the binding is missing and 200+
  tests collapse on `Database` instantiation.

- `src/cli/entry.ts`: runtime Node guard `< 18` → `< 24`. Error message
  updated to mention Active LTS.

- 7 test files realigned:
  - `tests/github/ci-workflow.test.ts`, `tests/github/workflows/ci.test.ts`,
    `tests/github/workflows/release.test.ts` — workflow assertions
    against the new matrix and fixed versions.
  - `tests/cli/bin-entry-validation.test.ts`, `tests/cli/npx-compat.test.ts`
    — engines.node and entry.ts guard assertions.
  - `tests/core/nervous-enabled-integration.test.ts` — `.deckent/config.
    json` dogfood-only assertion now skipped when the file is absent
    (PR #16 made the config gitignored).

## Local verification (Node 24.15.0, the current Active LTS)

| Gate | Result |
|------|--------|
| Non-orchestra suites | 475 files, **10,625 pass**, 23 skip, **0 fail** |
| Orchestra suite | 205 files, **4,416 pass**, 11 skip, **0 fail** |
| Dashboard suite | 23 files, **493 pass**, **0 fail** |
| `tsc --noEmit` | clean |
| `npm run build` | dist/cli/{index,entry}.js, dist/mcp/server.js, dist/index.js all present with shebang |
| VitePress build | complete |
| `secret-baseline.mjs` | 0 unallowlisted secrets |

Total: **15,534 tests pass, 0 fail**.

## Baseline note

This PR is based on `docs/embedded-web-terminal-spec` (PR #16). PR #16's
test/vitepress/secret-baseline fixes are inherited; once PR #16 merges
to main, this PR's base becomes main automatically with no conflict.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>