TS: brace-expansion@5 requires node >=20 while package.json engines say >=18

[jeremy]

Follow-up from a resolved Copilot thread on #412 (discussion), filed for durable tracking.

Observation

typescript/package-lock.json now pulls brace-expansion@5 (transitive dev-tooling dep), which declares engines.node: "20 || >=22", while typescript/package.json still advertises:

"engines": { "node": ">=18.0.0" }

Impact (non-blocking)

There is no .npmrc and engine-strict is unset, so npm treats the mismatch as a warning, never an npm install/npm ci failure — CI is unaffected today. It is a stated-support-range inconsistency, not a break.

Decision needed

A Node-18-support policy call: either

• (a) drop Node 18 and raise engines.node to >=20 (aligning with the transitive floor and dropping the Node 18 mentions in the runtime code), or
• (b) keep advertising >=18 and accept that a dev-tooling dep floors at 20 (harmless without engine-strict).

No urgency; capturing so the range stays intentional rather than drifting.