Set Node 24.19 minimum and experimental Node 26.9 compatibility

[Kevinjohn]

CapacityLens keeps Node 24 as its supported runtime and admits Node 26 experimentally, with explicit floors and a focused local check. This replaces the earlier draft’s full dual-runtime CI proposal. Closes #710.

• Enforce >=24.19.0 <25 || >=26.9.0 <27 in package engines, source preflight and built server, import-worker and password-recovery entrypoints before application writes.
• Preserve independent browser storage and consistent storage prototypes so error-path tests work on both runtimes.
• Add pnpm run check:node26 for selected storage/SQLite checks, timer-dependent backup success and rejection, and deployed server/import/backup/shutdown checks. Run it locally once weekly while development is active; ordinary fixes have no added Node 26 test step.
• Remove the proposed Node 26 workflow and unused setup override. No scheduled Node 26 Actions, runtime default/type/build-target change, dependency upgrade or schema change.
• Update installation/development documentation and regenerate the static pages. Preserve the September investigation as dated history.

Node 24.19.0 is supported and recommended. Node 26.9.0 is experimental and best-effort; complete functionality and a fix deadline are not guaranteed. Node 26-specific failures need not block Node 24 releases; shared correctness/security defects retain their normal priority. Recommend current patches within either admitted line.

Validation on macOS arm64 with pnpm 11.4.0:

Check	Result
Node 24.19.0 combined gate	Passed: 4,666 application tests, 2,596 server coverage tests, 56 account flows, 3 durability tests and 3 migration tests; coverage, static checks, audit and build passed.
Node 24.19.0 Chromium/DB/auth E2E	290 passed in 2.4 minutes.
Official Node 26.9.0 broader application/server unit runs	4,666 application and 2,596 server unit tests passed.
Official Node 26.9.0 focused local command	Passed in 71 seconds: storage, 51 SQLite authorization/backup checks, timer-dependent backup success/rejection, packaged import/snapshots/integrity/shutdown.
Official Node 26.9.0 historical backup matrix	All 18 cases passed natively on macOS; snapshots reopened for integrity/content checks.
Runtime floors and smoke harness	Portable boundary/refusal tests and meaningful startup-failure/environment-isolation tests passed; real Node 24.16.0 refusal also checked.
Automatic PR checks	Static analysis, CodeQL and documentation passed on final head.
Documentation and review	Build/navigation and visual inspection passed; independent scope review resolved its historical wording finding.

Final head: fdf9a801c95169b1a67ef9afe1b18af161ea0947. The recorded clean-tree Node 26 command used 7f8c5b4c; final head only groups the changelog entry. Other late changes were portable refusal-test wiring and local-command reporting/launcher corrections, with focused validation. No production behavior changed after the broader runtime runs.

Known limits: official Node 26.9.0 was tested natively on macOS arm64; current Linux evidence is outstanding. Existing historical Linux results apply to earlier runtimes. No new infrastructure, Docker or Node 26 CI was added to fill this gap. No full Node 26 browser/coverage matrix is claimed. No UI behavior changed, so no scheduler story or screenshot update is needed.

Leave this PR open; no merge, deployment or release is included.

[Kevinjohn]

The revised plan is now at the top of issue #710. It supersedes the earlier four-job Node 26 workflow and dual full-support acceptance.

• Node 24.x from 24.19.0 remains supported and recommended.
• Node 26.x from 26.9.0 becomes experimental, with best-effort compatibility. Establish the official 26.9.0 core-runtime baseline locally and record broader-test limitations.
• Remove the proposed scheduled Node 26 workflow and unused setup override; retain focused local storage/SQLite/packaged-runtime checks for weekly use. No additional Node 26 checks on ordinary fixes or scheduled GitHub Actions usage.
• Refresh the existing branch, enforce floors in source and packaged usage, update documentation, and retain the normal required Node 24 validation.

This is a planning update only. The PR remains draft; no implementation, merge, deployment, release or scheduler activation has occurred.

[Kevinjohn]

Polish review: one P2 fixed.

• P2 fixed: the source Node preflight was a no-op when run through a symlinked path.
  • Cause: check-node.mjs compared import.meta.url, which ESM resolves through symlinks, with the raw process.argv[1]. From a symlinked checkout, the refusal never ran.
  • Effect: source maintenance scripts that rely on this preflight (cutover:repair, recover:audit-outbox, rehearse:migrations) would then run on a refused Node. The release unit's ExecStartPre also calls the preflight through the /opt/capacitylens/current symlink.
  • Fix: the guard now compares with realpathSync(process.argv[1]).
  • Test: a new check-node.test.mjs case runs the preflight through a symlinked directory. Mutation check: putting back the old comparison fails it, and restoring the fix passes.
• Simplification: check:node26 now uses the shared supportsNodeVersion floor, and the patch comparison that was always true has been dropped. Admitted versions are unchanged.
• Checked and clean:
  • The pinned Docker base image runs Node 24.21.0, so it is admitted. Every workflow reads .nvmrc (24).
  • Version parsing fails closed for pre-release, 25.x and 27.x.
  • Each built entrypoint refuses before init, the umask or any database open.
  • The test-setup storage changes leave behaviour unchanged on Node 24.
  • The smoke scripts use temp directories and port 0.
• Ladder on Node 24:
  • format, lint, typecheck, file sizes and server tsc;
  • the full app suite (4,666 tests);
  • the server import-worker, health, runbook and documentation suites;
  • the node-runtime, packaged-smoke and run-gate tests;
  • policy:ports;
  • docs:build, with no drift.
• Note for anyone running check:node26 locally: scripts/smoke-packaged-server.mjs has the same main-module comparison. Run it from a non-symlinked path, or it skips its checks and still reports success.

Merge predecessor: none.