.npmrc

# engine-strict is deliberately NOT set here, and there is deliberately no
# `preinstall` runtime guard either. Both were tried on this branch; CI measured
# why neither works:
#
#   engine-strict=true — in pnpm this also hard-enforces every package's
#     os/cpu/libc, so the darwin/arm64 rolldown binding the lockfile carries for
#     local dev failed every linux job in ~20s with
#     ERR_PNPM_UNSUPPORTED_PLATFORM. Nothing to do with the Node version.
#
#   preinstall guard — fires inside the Docker `deps` stages, which COPY only
#     package.json + pnpm-lock.yaml, so it died on a missing script; and it does
#     NOT fire for a developer whose node_modules is already current (pnpm skips
#     lifecycle scripts on a no-op install), which is exactly the case that
#     needs catching.
#
# The exact Node pin rests on .nvmrc (read by fnm/nvm and every CI job through
# setup-node's node-version-file) plus build-time assertions in the three Node
# Dockerfiles. package.json advertises the compatible Node 22 engine range.