Enforce Node 24.19.0 / npm 11.17.0 via engines and engine-strict

[NicolasBonet]

Details

Enforces the Node/npm toolchain for this repo as a prerequisite for the npm min-release-age supply-chain cooldown. min-release-age requires npm >= 11.10.0 and is silently ignored by older npm versions. Node 24's earlier bundled npm is below that floor, while 24.19.0 bundles npm 11.17.0 — staying on the same 24.x LTS line avoids CI-image risk.

• .nvmrc: bumped from 24 to 24.19.0.
• package.json: added an engines field with exact pins (node 24.19.0, npm 11.17.0, matching App). This repo is not published to npm, so exact pins are appropriate.
• .npmrc: added with engine-strict=true so npm install/npm ci fail loudly (EBADENGINE) under a non-compliant toolchain. Removed the stale .npmrc entry from .gitignore — actions/setup-node writes auth config to a user-level npmrc via NPM_CONFIG_USERCONFIG, not the project file.
• package-lock.json: regenerated under Node 24.19.0 / npm 11.17.0 (metadata-only changes, no dependency version changes).

All CI workflows already read the Node version via node-version-file: .nvmrc, so no workflow changes were needed.

Related Issues

For https://github.com/Expensify/Expensify/issues/675045

Manual Tests

1. Under Node v24.19.0 / npm 11.17.0: npm install and npm ci both complete successfully.
2. Under the old toolchain (Node v20.20.0 / npm 10.8.2): npm install --dry-run fails with npm error code EBADENGINE — Required: {"node":"24.19.0","npm":"11.17.0"}, Actual: {"npm":"10.8.2","node":"v20.20.0"}.

Linked PRs

None.

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[NicolasBonet]

I have read the CLA Document and I hereby sign the CLA

[lakchote]

Could we also add .npmrc to the paths filters in lint.yml, oxfmt.yml, test.yml and typecheck.yml? This PR makes .npmrc an input to those jobs, but a follow-up that changes only .npmrc (like the planned min-release-age) currently triggers none of the workflows that run npm ci on the branch.

Adding it next to .nvmrc keeps those changes covered

[NicolasBonet]

Could we also add .npmrc to the paths filters in lint.yml, oxfmt.yml, test.yml and typecheck.yml? This PR makes .npmrc an input to those jobs, but a follow-up that changes only .npmrc (like the planned min-release-age) currently triggers none of the workflows that run npm ci on the branch.

Adding it next to .nvmrc keeps those changes covered

Added @lakchote

[lakchote]

LGTM