chore: refresh dependencies and CI maintenance

[hatefrad]

What changed

• refresh the npm lockfile within the existing dependency ranges
• remove the stale pnpm lockfile and keep npm as the canonical package manager
• test Node.js 20, 22, and 24 in CI and align size checks with the Node 24 publish job
• declare the supported Node.js baseline and refresh the maintenance checklist version

Why

The existing dependency graph contained development-tool advisories, and the repository had conflicting npm and pnpm lockfiles despite using npm throughout automation and contributor documentation.

Impact

There are no runtime API or library behavior changes. The refreshed npm dependency graph reports zero vulnerabilities.

Validation

• npm ci
• npm audit
• npm run release:verify
• git diff --check