Bump Node to 24.19.0 and enforce npm >= 11.10.0 toolchain

[NicolasBonet]

Details

Prep for rolling out npm's min-release-age cooldown (https://github.com/Expensify/Expensify/issues/636594). That setting requires npm >= 11.10.0, so this bumps and enforces the toolchain first:

• .nvmrc: 24.11.0 -> 24.19.0
• package.json: replace engines with devEngines requiring node >= 24.19.0 / npm >= 11.10.0 (same block as expensify-common). devEngines only applies to contributors, not consumers of the published package, so engines is dropped rather than maintaining two sets of requirements.
• package-lock.json: root entry synced to drop engines, no dependency changes

No .npmrc or min-release-age yet — that's a follow-up. CI already reads .nvmrc.

Related Issues

For https://github.com/Expensify/Expensify/issues/678052

Manual Tests

1. nvm use 24.19.0 && npm ci succeeds
2. npm run ts, npx eslint src, npx prettier . --check pass
3. nvm use 24.11.0 && npm ci --ignore-scripts fails with EBADDEVENGINES

Linked PRs

N/A

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[NicolasBonet]

I have read the CLA Document and I hereby sign the CLA

[AndrewGable]

I see two options here:

1. Continue using engines, as we have historically. We could update it to Node >=24.19.0 and npm >=11.10.0, although it only warns without engine-strict, I think it copies our existing patterns.

2. Treat this strictly as a development-toolchain requirement. Keep devEngines, but remove engines since the library itself does not require Node 20+. .nvmrc ensures contributors and CI use an npm version that supports devEngines, and CI’s npm install/npm ci will catch mismatches between them.

Option 2 seems more technically accurate and avoids maintaining two different sets of requirements. The remaining caveat is that npm <10.9 ignores devEngines if someone bypasses .nvmrc.

cc @roryabraham for other thoughts.

[roryabraham]

👍🏼 to keeping devEngines and dropping engines

[NicolasBonet]

Went with option 2 in 86ef72a — dropped engines from package.json and the lockfile root, kept devEngines.

[os-botify]

🚀 Published to npm in 1.0.35 🎉