chore: update node engine requirement and add node 22 ci tests

[weedgrease]

Summary

Lower the supported Node floor from >=24 to >=22 (the oldest maintained LTS) and
verify it with a Node 22 + 24 CI test matrix. @types/node stays on the active LTS
(24); the runtime floor is now guarded by CI rather than the type version.

Changes

engines.node: >=24.0.0 → >=22.0.0

• Node 22 is the oldest maintained LTS (Maintenance until 2027-04-30); Node 20 is EOL.
  @sd-jwt/* requires Node 20+, so 22 clears it.
• >=22 is a lower bound, not a pin — it still allows 24/26+ and never blocks newer
  runtimes.
• @types/node stays ^24 (dev / active-LTS line). Pinning it to the floor is not
  needed because the matrix below verifies the floor at runtime.

CI: Node 22 + 24 test matrix

• Split the test job into test-matrix (runs yarn test on Node 22 and 24) and an
  aggregate test gate (needs: test-matrix, if: always()).
• The gate keeps a single stable required check named test for the branch ruleset, so
  the matrix legs (test (22) / test (24)) don't need to be enumerated in branch
  protection. always() makes a cancelled leg fail the gate rather than pass silently.
• Other jobs (format, lint, typecheck, build, publint) continue on Node 24 from
  .node-version.

Docs

• CLAUDE.md Rule 5: rewritten for the floor-22 + matrix-guard model, including the
  invariant that the test-matrix low leg must equal the engines.node floor.
• CONTRIBUTING.md: requirement now >=22 (published floor) with dev on Node 24, plus
  a note documenting the CI matrix.

Deps

• Bump typescript-eslint ^8.61.1 → ^8.62.0 (lockfile refresh).

Test plan

• CI: test runs on Node 22 and 24; format / lint / typecheck / build / publint on 24.
• Local: yarn check-all clean; node --test test/*.test.mjs passes on Node 24.