engines.node is pinned to exactly v26.12.1 while the repository runs Node 24 #549

What happens

Since 0.27.1 the published package's engines.node reads v26.12.1. Before, it read >=24. The change came in with the Renovate PR #64 ("pin node.js to v26.12.1"), which pinned the engines range as if it were a dependency. .nvmrc still says 24.21.0, and every consumer installs deploy-kit on Node 24: github-workflows' publish-fragment (default node-version: "24") and the estate's compose.yml (Node 24). Each install now warns EBADENGINE. It would fail outright anywhere engine-strict is on.

Found on 2026-10-21 while moving github-workflows to 0.28.0 (JorisJonkers-dev/github-workflows#193).

What should happen

engines.node states the lowest Node the package runs on, as a range (>=24), and Renovate never pins it.

Acceptance criteria

• package.json declares "engines": { "node": ">=24" } again.
• Renovate leaves engines alone: a packageRules entry (here or in JorisJonkers-dev/renovate-config) with matchDepTypes: ["engines"] and enabled: false, or rangeStrategy: "auto" for it.
• A packed tarball's package.json shows the range (npm pack --dry-run --json).