Pin npm toolchain

[foundev]

Summary

• declare npm 10.9.4 as the repository package manager
• enforce that exact npm version for local install, ci, and run commands through devEngines
• install npm 10.9.4 explicitly in every GitHub Actions job before npm ci

Why

PR #30 exposed a cross-major npm lockfile rewrite: npm 11 removed Vitest's required nested esbuild 0.28.1 platform packages, while the Node 22 CI environment rejected that lockfile. Regenerating with npm 10 fixed the immediate lockfile, but without a toolchain pin the next npm 11 dependency update could recreate the failure.

packageManager documents the selected tool, while devEngines prevents a mismatched npm from mutating the project. The workflow setup makes CI independent of whichever npm minor ships with Node 22.

Validation

• npm 11.16.0 project install rejected with EBADDEVENGINES before lockfile mutation
• clean npm ci with npm 10.9.4
• full npm test
• workflow YAML parse
• assertion that all five npm ci jobs pin npm 10.9.4
• git diff --cached --check