chore(ci): bump CI Node 20→24 and raise engines floor to >=20

[shivprime94]

What

June 2026 Node.js security-release hygiene. grauity's CI ran on EOL Node 20; this bumps it to Node 24 (Active LTS) and raises the published-package engines floor off EOL Node 18.

Changes

• build-storybook.yml, publish-npm-package.yml, run-tests.yml: node-version: 20 → 24
• package.json engines.node: >=18.0.0 → >=20.0.0 — ⚠️ consumer-facing: stops advertising support for EOL Node 18. Kept at >=20 (not >=22) to avoid breaking consumers still on Node 20 (newton-web / public-website are on Node 20 today, mid-migration to 24).
• package.json version: 3.4.0 → 3.5.0 (minor) — required so the engines change actually reaches consumers. 3.4.0 is already published on npm with engines >=18, so without a bump the support-contract change would never ship. Minor (not patch) because it's a consumer-visible support-contract change; it breaks no current consumer at >=20.
• package-lock.json: root version/engines re-synced to match package.json (the lock previously still read >=18.0.0).

Why bare 24 (not 24.17.0)

For CI runners we want the latest patched 24.x pulled automatically; pinning an exact minor is only for production runtimes.

Verification (local, Node 24.6.0)

• run-tests PR gate (npm ci + npm run test): 412 tests pass, typecheck clean.

Context: Node.js June 2026 security release (Node 18/20/12 are EOL — no patch). This repo is CI-only on EOL Node, so this is hygiene, not a production CVE fix.

🤖 Generated with Claude Code

[MihirSachdeva]

Review — verified locally on Node 24.17.0 ✅ with 3 changes requested before merge

Part of an end-to-end check of the whole June-2026 Node 24 migration.

The Node 24 CI bump is solid. Verified on Node 24.17.0 (fresh npm ci):

• npm run build (icons + lib + tokens + typings, 1082 dist files) ✅
• npm run test → 412 passed ✅ · typecheck ✅ · lint (ESLint 7 runs fine on Node 24) ✅
• npm run build-storybook ✅ (214 files) · npm pack ✅

Please address before merge:

1. engines.node value contradicts the PR description. The diff sets >=22.0.0, but the description says >=20.0.0 ("kept at >=20 … to avoid breaking consumers still on Node 20"). The consumers (newton-web, public-website) are on Node 20.11.0 today and are migrating to 24 in this same batch — and since this PR doesn't bump the version (see #2), the change is effectively inert for now — but the committed value should still match the intended floor:

-    "node": ">=22.0.0"
+    "node": ">=20.0.0"

(If >=22 is deliberate, please update the description and confirm no consumer lags on <22.)

2. No version bump → the change can't ship. 3.4.0 is already published on npm (with engines >=18). Without a version bump the engines change never reaches consumers, and a release cut from this branch would no-op. Recommend a minor → 3.5.0 (it's a consumer-visible support-contract change, but breaks no current consumer at >=20).

3. package-lock.json is out of sync — its root engines still reads >=18.0.0. Run npm install after the edit so the lockfile re-syncs.

And please update the PR description to match the final engines value.

With those, good to go.

[shivprime94]

@MihirSachdeva all 3 addressed in 29b0aaf:

1. engines.node >=22.0.0 → >=20.0.0 (your suggested diff — matches the description; keeps Node 20 consumers working mid-migration).
2. Version bump 3.4.0 → 3.5.0 (minor) so the engines change actually ships.
3. package-lock.json re-synced via npm install --package-lock-only — root version→3.5.0 and engines.node→>=20.0.0; no transitive dependency drift (only the 3 root-metadata lines changed).

Description updated to list the version bump + lockfile sync. Thanks for the catch 🙏