fix: preserve workflow-selected Node runtime

[bobaikato]

Summary

• preserve the first runnable Node executable selected by the workflow PATH
• use the action's Node 24 runtime only as a fallback for Ota child invocations
• add a three-OS Node 20 smoke assertion and rebuild dist

Validation

• npm test (50 passing)
• npm run build
• git diff --exit-code -- dist
• actionlint .github/workflows/*.yml
• ota run ci --agent

Reviewed independently by MUSE. Hosted Ubuntu, macOS, and Windows smoke jobs remain required before merge.

[github-actions]

Ota

Status: READY
Outcome: Ota reported a ready result.

References

• Command: /home/runner/.cargo/bin/ota receipt --json --archive --mode native .
• Output JSON: /home/runner/work/action/action/.ota-action-output.json
• Current archive: /home/runner/work/action/action/.ota/receipts/repo-receipt-20260925-223353-698Z.json
• Artifact: ota-readiness in this run
• Baseline restore: none from ota-readiness; current receipt only

Primary finding

Repo local Ota artifacts are not ignored by git

Why: .ota/state/, .ota/contracts/, .ota/receipts/, and .ota/proof/ store Ota-owned local runtime artifacts; if they are tracked by git, execution residue, archived semantic snapshots, receipts, and runtime proof artifacts can pollute repo diffs and diagnosis artifacts

Next steps

• run ota doctor --fix --dry-run to preview adding .ota/state/, .ota/contracts/, .ota/receipts/, and .ota/proof/ to .gitignore, or add the ignore rules manually

Counts

• Errors: 0
• Warnings: 12
• Info: 0