build: align fresh setup with Node 22

[WalksWithASwagger]

Closes #321

Summary

• require Node.js 22.12+ across CI, root and frontend packages, docs, and agent guidance after explicit maintainer approval
• document a reproducible fresh-clone install for root npm, frontend npm, and activated Python runtime/development dependencies
• make npm run verify the truthful canonical deterministic gate used by CI
• document the portal output-directory prerequisite

Acceptance Self-Check

• Runtime requirements agree across root/frontend packages and locks, README, contributing guidance, the project skill, and CI
• Fresh-clone setup installs root, frontend, runtime Python, and development Python dependencies and activates the virtualenv
• Portal docs require an existing output directory or explicit --output-dir
• One root command runs lint, Python tests, frontend verification, portal E2E, docs, public-boundary, dry-run smoke, package, and doctor gates
• CI invokes that canonical deterministic command after separate dependency audits
• Documentation distinguishes deterministic verification from networked audits

Verification

• root and frontend npm ci pass under Node 22.22.3 / npm 10.9.8 with zero engine warnings and zero vulnerabilities
• focused workflow and Varlock contract tests: 20 passed
• canonical npm run verify: 552 Python tests and 7 frontend tests passed; build, portal E2E, docs, public boundary, dry-run smoke, package boundary, and doctor passed
• Node runtime audit: zero vulnerabilities
• Python runtime audit: no known vulnerabilities
• Varlock environment audit and staged scan passed
• git diff --check passed

No provider calls, deployment, publication, dependency-version changes, or repository-settings mutations were performed.

[github-actions]

Agentic PR Review

Verdict: review-ready

Checks:

• Linked issue via Closes #... or Refs #...: yes
• Issue acceptance criteria found: 6
• PR verification section present: yes
• PR acceptance self-check present: yes
• Diff within v1 limits: yes