chore: upgrade to NPM v12

[coderbyheart]

Require npm >=12.0.2 <13 for this project (Node.js stays at >=16.20.0). It is enforced via
check-node-version from the prepare script.

Why

npm v12 turns three code-execution paths off by default — most notably the
unauthorized execution of install scripts, which is the primary vector for
supply-chain attacks via compromised dependencies
(GitHub changelog):

• allowScripts now defaults to off, so npm install no longer executes
  preinstall, install or postinstall scripts from dependencies unless they
  are explicitly allowed in package.json. This also covers prepare scripts
  from git, file and link dependencies.
• --allow-git now defaults to none, which closes a code-execution path
  where a git dependency's .npmrc could override the git executable, even with
  --ignore-scripts.
• --allow-remote now defaults to none, blocking dependencies from remote
  URLs such as HTTPS tarballs.

Pinning engines.npm to >=12.0.2 <13 and failing the install when it is not
met means these protections cannot be silently bypassed by running an older npm
locally or in CI.

How

• engines.npm is set to >=12.0.2 <13. engines.node is left untouched.
• check-node-version --package runs from the prepare script, which npm
  executes on npm install and npm ci.
• CI installs the npm version declared in engines.npm through the new
  .github/actions/install-npm composite action, added after each
  actions/setup-node step.

⚠️ Blocked: CI Node.js is too old for npm 12

This PR cannot go green as-is. npm 12.0.2 itself requires Node.js
^22.22.2 || ^24.15.0 || >=26.0.0, and this repository's CI runs an older
Node.js, so installing npm 12 fails before anything else runs:

npm ERR! code EBADENGINE
npm ERR! notsup Required: {"node":"^22.22.2 || ^24.15.0 || >=26.0.0"}

Bumping Node.js was explicitly out of scope for this change, so the PR is left
here for a decision:

1. bump the Node.js version in CI (and engines.node) to a release npm 12
   supports, or
2. skip npm 12 for this repository.

Everything else in the diff is complete and correct.

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit d68bee0. Configure here.}

[cursor]

Node sixteen incompatible with npm twelve

High Severity

The project still requires Node >=16.20.0 and CI uses Node 16, while npm is pinned to >=12.0.2 <13. npm 12 only supports Node ^22.22.2, ^24.15.0, or >=26.0.0, so the composite install-npm step and local installs on Node 16 can fail when upgrading npm, especially with engine-strict=true in .npmrc.

Additional Locations (2)

• .github/workflows/build.yml#L14-L17
• .github/workflows/test.yml#L14-L17

 

^{Reviewed by Cursor Bugbot for commit d68bee0. Configure here.}