ci: Node 22/24 test workflow; better-sqlite3 13 to stop the Node 24.19 ObjectWrap abort

[Freshair129]

Summary

Two infrastructure fixes, no pipeline logic touched (packages/gks-core/src/pipeline.mjs is untouched; PR #7 owns it).

1. CI (GKS had none). .github/workflows/test.yml runs npm ci + npm test (vitest contract + integration, then the node:test security suite) on ubuntu-latest, Node 22 and 24 matrix, on pull_request and push to main. actions/checkout v7.0.1 and actions/setup-node v7.0.0 (npm cache) are pinned to commit SHAs; permissions: contents: read; no secrets. The external MSP integration suite skips without MSP_REPO_ROOT, as intended.
2. Node 24.19 SQLite abort. better-sqlite3 ^11.10.0 → ^13.0.3; root engines.node >=20 → >=22 (13's floor).

Root cause of the abort

node::RemoveEnvironmentCleanupHook ... Assertion failed: (env) != nullptr under Statement::~Statement is an upstream Node.js regression. It is not caused by how GKS caches or closes statements:

• Node 24.19.0 backported src: add cleanup hooks to node::ObjectWrap (nodejs/node#63642) into the header-only node_object_wrap.h: the constructor adds a cleanup hook, and ~ObjectWrap() calls RemoveEnvironmentCleanupHook(Isolate::GetCurrent(), …). It did not backport the global addon cleanup-hook registry (1723773d), which is what makes removal safe without a live Environment. So when V8 collects a wrapped object with no entered context (allocation-driven GC, weak callback), Environment::GetCurrent is null and the CHECK aborts. Tracked as nodejs/node#65446. The v24 backport of the registry is still open (nodejs/node#65943). I checked the tags: v24.20.0 and v24.21.0 still have the new header and no CleanupHookThunk in src/api/hooks.cc, so upgrading Node does not fix it yet.
• The code only lands in an addon that is compiled against 24.19+ headers. better-sqlite3 11.10.0 publishes no node-v137 prebuild, so npm ci on Node 24 builds it from source against those headers. Any Statement collected by GC can then abort the process, including mid-run with the Database still open. The "statement outlives db.close()" hypothesis does not hold: GC of any statement can trigger it.
• Binary evidence on this machine: the 11.10.0 source build imports RemoveEnvironmentCleanupHook. The 12.11.1 prebuild (built before 24.19) imports only AddEnvironmentCleanupHook. The 13.0.3 prebuild imports neither and uses napi_wrap.
• better-sqlite3 13.0.0 is a node-addon-api rewrite (Statement : Napi::ObjectWrap<Statement>) that ships its prebuilt binaries inside the package (release notes), so it is structurally outside the broken header. For reference, the upstream report WiseLibs/better-sqlite3#1515 was closed as not planned, pointing at the Node regression.
• 12.11.1 would also pass today, but only because its prebuild predates 24.19; any source build of it would re-arm the abort. So 13 is the durable choice. API usage is unchanged, and the full suite passes on 13 without code edits.

Verification (this machine: Windows 11, Node v24.19.0)

	pipeline-genesisrag17.test.mjs (vitest)	security suite (node:test)
before, better-sqlite3 11.10.0 (source build)	Assertion failed: (env) != nullptr, worker exited unexpectedly	abort, file fails, tests 1 / pass 0 / fail 1
after, better-sqlite3 13.0.3	16 / 16 passed	10 / 10 passed

Full npm test after a clean npm ci: vitest 19 files passed | 2 skipped (21), 156 tests passed | 2 skipped (158); node:test security 10 pass, 0 fail. The 2 skips are the external MSP tests (msp-provider-compatibility, msp-service-chain), which skip because MSP_REPO_ROOT is unset.

Docs

• README.md 0.2.2b → 0.2.4b: toolchain note (Node >=22, the workflow, why 11.x/12.x must not return). The version is 0.2.4b because open PR feat(pipeline): produce ontology_v2, gate {ontology_v1, ontology_v2} (ADR-075 Phase 2, step 2) #7 takes 0.2.3b. The frontmatter lines will conflict textually with feat(pipeline): produce ontology_v2, gate {ontology_v1, ontology_v2} (ADR-075 Phase 2, step 2) #7; whichever PR merges second keeps both CHANGELOG rows.
• docs/RUNBOOK-GKS-LOCAL.md 0.2.1b → 0.2.2b: replaced the "rebuild better-sqlite3 against 24.18.x headers" step with the reason it is no longer needed, and named the CI workflow.

No DPS-KI-* stage is advanced by this PR. It is test and CI infrastructure only.

🤖 Generated with Claude Code