fix(stryker-js-vitest-runner): require Node 24 and document the V8 JSON.parse key bug

[systemfsoftware-maker]

Summary

The intermittent ∀x_CountedReportJson_=x and ∀x_KillMatrixReportJson_=x failures (one of them turned #294's check red) are not a schema defect. On Node 24, after V8's JSON.parse has read an object key that ends in an escaped backslash, a later escaped key in the same position can decode to that cached key. This is nodejs/node#63785. V8 fixed it in 93cd21e825, and the Node 24 backport nodejs/node#66542 is still unmerged. Node 22 (V8 12.4) is not affected.

The ruling for this flake is to document the bug and declare the real runtime floor. There is no CI pin, no schema or generator change, no seed pin, no custom parser and no pinned regression test.

Changes

• packages/stryker-js/README.md: a new Known issues section. On Node 24.x (and 26.x up to at least 26.7.0), JSON.parse can return the wrong key in a long-lived process, which affects reading report JSON in the same process. It cites #63785 and #66542 and says to re-check and remove the entry once a Node 24 release carries the #66542 backport.
• packages/stryker-js-vitest-runner/package.json: engines.node changes from >=22.18.0 to >=24.13.1, the same floor as @systemfsoftware/stryker-js. The runner calls the built-in RegExp.escape, which Node 22 lacks, so a mutant run that filters to named tests ended in an error on Node 22.
• packages/stryker-js-vitest-runner/README.md: the prerequisite now says Node.js >=24.13.1, matching engines.
• Changesets: major for @systemfsoftware/stryker-js-vitest-runner (BREAK-1: narrowing engines is a break, so 9.0.2 becomes 10.0.0), and patch for @systemfsoftware/stryker-js (README only).
• Solution docs (docs-only, same bug):
  • stream-schema-must-not-carry-json-rest-records.md: states what the #63785 version sweep (2026-08-21) measured. V8 13.6 and 14.6 (Node 24 and 26) are affected, V8 12.4 (Node 22) is not, and the regression lies somewhere between 12.4 and 13.6. A 2026-10-05 comment also reports it on Node 24.21.0 and 26.10.0. A local probe on Node 22.23.3 also returns the right key.
  • v8-json-parse-key-corruption-schema-laws.md: no property seed is pinned any more (the hook left in chore(repo): move to the latest @systemfsoftware packages and the @systemfsoftware/vitest fork #109 and the pin in fix(repo): repair the vm runner and config subpath after 11.0.0 #110). A new Current State section points at the README known issue and gives the removal condition (a Node 24 release with the #66542 backport).

Review (report-only ce-code-review on 2829670f6, rulings applied)

#	Sev	Finding	Ruling
2, 3, 4	P1/P2	The runner's Node floor raise shipped as patch, but BREAK-1 (AGENTS.md) ships a break as major.	Accepted. The changeset is now major.
1, 5	P1/P2	The runner README still said Node.js >=22.18.0.	Accepted. It now says >=24.13.1.
risk	-	The runner README and changeset should point at the known issue.	Rejected. Runner users install stryker-js, whose README carries it.
risk	-	stryker-js-plugin-runtime and the stryker-js-typescript-checker README still claim >=22.18.0.	No change in this PR. git grep -n 'RegExp.escape' -- 'packages/*/src' finds it only in stryker-js-vitest-runner (2 call sites).

Verification

• pnpm install --frozen-lockfile passes with no lockfile change.
• dprint check is clean.
• The changeset validator passes both changesets.
• The solution-doc validator passes both docs.
• No mutation, e2e or build was run locally.

Placement (OP13b)

This PR is off main by ruling. These open PRs also change one of its files, and whichever lands second takes the merge:

• fix/manifest-document-keys: docs/solutions/test-failures/stream-schema-must-not-carry-json-rest-records.md
• fix/gate-merged-break, stryker/verdict-store, stryker/verdict-store-ci: packages/stryker-js/README.md

[ryanleecode]

Verified at 3aec05e: all checks green except the bench typescript-checker leg (fails on every PR); 0 open threads; diff is engines floor + READMEs + changesets + solution docs, no skips/disables/pins. Review dispositions in body (major per BREAK-1 accepted, README floor accepted, two risks ruled with grep evidence). Review lenses ran on omp's reviewer routing (MiniMax M3.1, omp-config.yml:42-53; generic task/reviewer agents disabled), so the cross-model pass is present. Main delta since CI: #293, test-only.