chore!: baseline Node 24 + apply held majors (lcr@5, write-file-atomic@8) + fix snyk phantom debug dep

[theagenticguy]

Summary

Lifts the Node baseline to 24 and applies the two major dependency bumps that were held back in #230 solely because they require Node ≥ 24. Also addresses the snyk-nodejs-lockfile-parser phantom debug dependency surfaced by the Node 24 global-install smoke test.

BREAKING: minimum Node is now 24.15.0 (was 22.12.0). Node 22 is dropped. 24.15.0 is the floor where both majors below install under engine-strict=true.

Node 24 baseline

• engines.node >=22.12.0 → >=24.15.0 across the root + all 18 packages
• mise.toml node pin 22 → 24; .nvmrc / .node-version 22 → 24
• ci.yml: both test matrices drop Node 22 (now [24])
• verify-global-install.yml: the six Node-22 legs flip to 24 (dropping the now-duplicate linux-x64-node24-mise), keeping every installer × OS × arch combo (mise/nvm/homebrew/volta across linux x64/arm64, macOS arm64/x64)
• README: "Node 22 or 24" → "Node 24+"

Held majors (unblocked by Node 24)

Package	From	To	Notes
license-checker-rseidelsohn	4.4.2	5.0.1	needs node>=24; powers the required licenses gate
write-file-atomic	7.0.1	8.0.0	runtime dep in cli, ingestion, analysis, wiki

License allowlist update (required by lcr@5): v5 walks the tree via @npmcli/arborist and reports raw SPDX expressions instead of normalizing them, so it surfaces permissive licenses v4 hid. Added to all four callers (ci.yml, pre-release-gate.yml, scripts/acceptance.sh, mise.toml):

• Python-2.0 — argparse (via js-yaml); PSF, OSI-approved permissive
• CC-BY-3.0 — spdx-exceptions (a data package, not code)
• MIT OR Apache-2.0, (Apache-2.0 AND MIT), (BSD-3-Clause AND Apache-2.0), (BSD-2-Clause OR MIT OR Apache-2.0), (MIT OR CC0-1.0) — compound expressions of already-allowed licenses

snyk phantom debug dependency

snyk-nodejs-lockfile-parser@2.8.0 does require("debug") without declaring it — it relied on npm's flat hoisting. Added a pnpm packageExtensions entry injecting debug@4.4.3 into snyk's deps, which fixes resolution for pnpm install (the dev workspace + anyone installing from our lockfile + CI).

Honest scope note: a bare pnpm add -g <tarball> global install still can't see it — global installs don't read workspace packageExtensions, and bundling snyk into the dist isn't viable (it does a dynamic require("fs") that breaks ESM bundling). The documented and CI-tested global path is npm install -g, which flat-hoists debug and works end-to-end. I verified codehub analyze of an external repo via npm install -g on Node 24 (7040 nodes, 17841 edges, clean).

Validation (Node 24.16.0, mirrors required CI)

Gate	Result
frozen-lockfile install	✅ no drift
build (all packages)	✅
lint (biome 2.5.0)	✅
typecheck (CI-mirror)	✅
test (19 packages)	✅ 2169 tests, 0 fail
banned-strings	✅
license allowlist (lcr@5)	✅
OSV scan	✅
pack determinism	✅
npm install -g → codehub analyze	✅ external repo, end-to-end

🤖 Generated with Bonk — OpenCodeHub maintenance