chore: pin npm via corepack to stop package-lock drift

[marc0olo]

Problem

npm i kept rewriting package-lock.json with no dependency change. The cause is npm-version skew between contributors and CI — and it turned out to bite at the patch level:

• CI pinned node-version: 22 → npm 10; local Node 24 → npm 11. npm 11 serializes the lockfile differently (peer flags, optional-peer handling), and since npm ci never rewrites the lockfile, the format ping-ponged between anyone who ran npm i.
• Worse, even within npm 11 the behavior differs by patch: npm 11.6.2 (a local Node 24 build) prunes the optional-peer @emnapi/core / @emnapi/runtime entries, while CI's npm 11.16.0 npm ci requires them. A lockfile written by 11.6.2 therefore fails CI with npm ci can only install ... when package.json and package-lock.json are in sync.

So a version floor alone is not enough — the fix has to make everyone use one exact npm.

Fix

Pin the exact npm with corepack, for contributors and both CI jobs:

Change	Purpose
package.json → "packageManager": "npm@11.16.0"	corepack resolves this exact npm locally + in CI, regardless of what Node bundles
corepack enable step in both workflows	CI uses the pinned npm instead of Node's (drifting) bundled npm
engines: node >=22, npm >=11.16.0 + .npmrc engine-strict=true	A pre-11.16.0 npm fails fast instead of silently rewriting the lockfile
.nvmrc → 24; both workflows node-version: 22 → node-version-file: .nvmrc	Single Node pin; CI + nvm use stay aligned
package-lock.json regenerated with npm 11.16.0	Canonical, complete tree (keeps the optional-peer entries CI needs)

The lockfile diff is a 12-line normalization: adds the engines block and lets npm 11.16.0 tidy peer flags. No dependency version or integrity changes; 0 vulnerabilities.

Contributor note (one-time)

corepack ships with Node. Enable the npm shim once:

corepack enable npm

After that, npm in this repo automatically resolves to the pinned 11.16.0. If you're on an older npm without corepack enabled, engine-strict will refuse to install until you do.

Verification

corepack-resolved npm ci + build + stability

$ npm -v
11.16.0                      # via corepack, from packageManager pin

$ npm install --package-lock-only   # settled lockfile
LOCKFILE UNCHANGED           # stable — no churn across runs

$ npm ci
found 0 vulnerabilities

$ npm run build
[build] 30 page(s) built
[build] Complete!

[github-actions]

Skill Validation Report

No skill files were changed in this PR — validation skipped.