fix: restore audited Node runtime compatibility

[rogerchappel]

Summary

• pin the patched brace-expansion runtime resolution that closes GHSA-mh99-v99m-4gvg
• raise the advertised runtime floor to Node 20.9 because the patched dependency no longer supports Node 18
• keep CI and README support claims aligned with the executable dependency floor

The prior Node syntax and installed-package regression coverage were already addressed on main by #9. This PR resolves the remaining release-gate failure without advertising a runtime that the patched dependency cannot support.

Commit-by-commit changes

• fix: adopt patched runtime dependency floor — overrides brace-expansion to 5.0.8, refreshes the lockfile, and aligns package engines with its Node 20 floor
• ci: test the supported Node release lines — removes Node 18 from the release matrix and updates the documented support range

Verification

• npm ci
• npm audit --omit=dev (0 vulnerabilities)
• npm run release:check (71 tests passed; typecheck, lint, source smoke, packed CLI install/invocation all passed)
• git diff --check origin/main...HEAD
• commit identity audit: both commits are authored and committed by Roger Chappel miscanalysis@gmail.com

Risk

Node 18 users must remain on the prior package version. Node 20.9, 22, and 24 are exercised by CI.

Rollback

Revert both commits to restore the previous dependency resolution and Node support declaration.