build: require Node 24.19.0 and npm 11.17.0

[velocitysystems]

Why

npm's min-release-age / min-release-age-exclude refuse to install package versions that
have not been public for a given number of days — a cheap, high-leverage mitigation against
registry compromises like Shai-Hulud/ChainDrop, which arrive as freshly published versions of
otherwise-trusted packages.

Those flags require npm >= 11.14.0. This repo pins npm 11.8.0 via check-node-version, so
they are currently unavailable. Node 24.19.0 (Krypton LTS) bundles npm 11.17.0 exactly, so
a single .nvmrc bump delivers both.

This PR is only the toolchain upgrade that makes those flags usable. It deliberately does not
set any release-age policy itself, so .npmrc is untouched.

What changed

File	Change
.nvmrc	24.13.1 → 24.19.0
package.json	check-node-version --npm 11.17.0

No .npmrc, dependency, or lockfile changes.

Verification

• Confirmed against nodejs.org release metadata that Node v24.19.0 ships npm 11.17.0, so the
  .nvmrc bump alone pins both versions.
• Confirmed npm 11.17.0 supports min-release-age and min-release-age-exclude (added in
  npm 11.14.0), so the upgrade achieves its stated purpose.