Pin recommended Node via .nvmrc and enforce engines via .npmrc (engine-strict) #52

Context

PR #51 added "engines": { "node": ">=20.9.0" } to package.json to match next@16.2.6's declared minimum. Two adjacent gaps were left out of that PR on purpose to keep its scope narrow:

1. No .nvmrc / .tool-versions — the supported matrix (>=20.9.0) is now declared, but the recommended version contributors should pick locally is not. CI runs Node 24 (see .github/workflows/website.yml and .github/workflows/docs.yml), and that's the version we actually test against.
2. No .npmrc with engine-strict=true — pnpm currently only warns on engines.node mismatch instead of failing the install. The new engines field is therefore a soft hint, not an enforced contract.

Proposal

Two small, independent additions:

• .nvmrc containing 24 (or lts/jod / similar) so nvm use / Volta / fnm pick the version CI uses.
• .npmrc containing engine-strict=true so pnpm install hard-fails when Node is below the engines.node floor — gives new contributors a clear error early instead of an opaque Next runtime failure later.

Open questions

• .nvmrc value: pin 24 (matches CI exactly) or 20 (matches the declared engines floor)? 24 favors "tested matches local"; 20 favors "lowest supported." CI matters more, so default to 24 unless someone disagrees.
• engine-strict blast radius: any contributor on Node <20.9.0 will be hard-blocked from installing. That's the point, but worth calling out in the PR description.

Out of scope here

This is the follow-up split from #51 (security bump + engines declaration). Filed so the strict-enforcement and recommended-version policy can land together as their own change rather than expanding a security patch.