feat: bump @types/node to 24.12.2, engines.node >= 22

[theagenticguy]

Summary

Partial fix for #19. Raises the supported runtime floor and gets type-level Node 24 coverage in place ahead of the full Node 24 CI matrix.

• @types/node → 24.12.2 across all 11 package.jsons
• engines.node → >=22.0.0 (Node 20 is EOL)
• License allowlist: add BlueOak-1.0.0 + 0BSD (lru-cache@11.3.x relicense from ISC)
• Stale setup.test.ts plugin-version assertion fixed (2.0.0 → 0.1.0)

Why no Node 24 in the CI matrix

tree-sitter@0.25.0 (current latest on npm) does not compile against Node 24's V8 ABI — signatures like v8::Template::Set and v8::internal::Internals::ReadExternalPointerField<...> changed, and there are no prebuilt binaries in the 0.25.0 tarball to bypass the source compile.

The upstream fix is already merged and tagged as v0.25.1 (commit f8805e7), but the npm publish is blocked on an OIDC Trusted-Publishing misconfig — see tree-sitter/node-tree-sitter#268 (the C++20/Node 24 compat bug) and #276 (the publish blocker). Both are open as of 2026-04-21.

Once 0.25.1 lands on npm, re-adding Node 24 to the matrix is a one-line CI diff — and with @types/node@24.12.2 in this PR we still get early type-level Node 24 coverage today. Tracking: see follow-up issue.

Why no TS4111 fixes?

Issue #19 listed 17 call sites that @types/node@22+ would break. In practice zero surfaced under @types/node@24.12.2 — the sarif package already used bracket notation (record["rules"], pf["primaryLocationLineHash"], etc.) at every flagged site. The concern in #19 was forward-looking; the code had already evolved into the correct shape.

Test plan

• pnpm -r build clean
• pnpm -r exec tsc --noEmit clean under @types/node@24.12.2
• pnpm -r test → 952 pass / 0 fail under Node 22.22.0
• pnpm -r test → 952 pass / 0 fail under Node 24.15.0 (local-only, tree-sitter binaries already cached)
• biome ci . clean (52 warnings / 484 infos are pre-existing — separate PR)
• bash scripts/check-banned-strings.sh clean
• license-checker-rseidelsohn clean with expanded allowlist
• CI: all jobs green on the PR

Follow-up

• New issue: re-add Node 24 to CI matrix once tree-sitter ≥ 0.25.1 is published to npm.
• Biome cleanup pass (bump @biomejs/biome 2.4.0 → 2.4.12 and review the 52 warnings in isolation).