test(dev-environment): pin package.json engines.node into the Node-major parity chain

[hivecommons-hive]

Test Improvement

The repository pins one Node major in four places and guards three of them:

• .devcontainer/devcontainer.json → "node": { "version": "22" }
• every workflow → node-version: 22 / NODE_VERSION: '22'
• CONTRIBUTING.md and the developer docs → the prose prerequisite
• tests/dev-environment.test.mjs:364 and :386 already assert
  devcontainer ↔ workflows and docs ↔ devcontainer parity

package.json declared no engines field, so the one Node pin npm itself
reads was missing. Every other declaration has to be opened to be seen; a
contributor who clones outside the devcontainer and never reads CONTRIBUTING
got no signal at all, and npm ci silently endorsed whatever major happened to
be installed.

This PR closes that link:

• package.json gains "engines": { "node": "22.x" }, matching the major the
  devcontainer and every workflow already pin.
• tests/dev-environment.test.mjs gains
  package.json engines.node matches the pinned Node major, placed beside the
  two existing parity assertions and reusing devcontainerNodeMajor(), so a
  future Node bump that misses package.json fails the suite the same way one
  that misses the devcontainer already does.

The field is advisory. The repository ships no .npmrc with
engine-strict, so a contributor on another major gets npm's warning, not a
failed install. No workflow file is touched, and the pinned major is unchanged.

Verification

Run locally at 03cfcfe + this commit, node v26.10.0 — deliberately a major CI
never runs, which is the condition the new guard exists to make visible:

• TZ=UTC node --test tests/dev-environment.test.mjs → 17 pass, 0 fail
• Negative control: temporarily setting engines.node to 20.x fails the new
  test with
  package.json engines.node (20.x) pins a different Node major than the devcontainer (22);
  reverted.
• npm run test:unit:coverage:check → exit 0, 2026 tests pass,
  src files | 100.00 | 99.92 | 8984/8984 lines | 2545/2547 regions
• npx prettier --check package.json tests/dev-environment.test.mjs → clean

Coordination

Touches package.json and tests/dev-environment.test.mjs only. Checked
against every open hold-gated PR: #1161 (scripts/audit-gate.mjs), #1163 /
#1174 (tests/tools/e2e-coverage-report.mjs, tests/e2e-coverage-run.test.mjs),
#1165 (tests/architecture-content-mirror.test.mjs), #1166 (CONTRIBUTING.md),
#1168 / #1176 (scripts/lib/svg-active-content.mjs), #1171
(tests/tools/e2e-data-fixtures.cjs, tests/e2e-data-fixtures.test.mjs,
tests/e2e/fixtures/**), #1178
(tests/e2e/focus-trap-trigger-unmounted.spec.js). None of them touches either
file. Branch cut from a fresh origin/main.

Related Issue

Closes #1182

---

Filed by quality agent (hold-gated mode). Human review required.

— hive: agent=quality backend=copilot model=claude-opus-5 copilot=1.0.88

[hivecommons-hive]

Important

Held for human review by the hive's ACMM level gate.

This PR was opened by the "quality" agent while Hive policy required a human checkpoint for that agent. Non-outreach agents are held at ACMM L3–L5; the outreach agent is always held because it publishes project-facing communication.

Hive will keep the hold label until a human removes it. Operators can make a deliberate one-off release during an ACMM level change with release_level_holds=true, but level changes never release this hold automatically.