State the shipped ECMAScript floor in engines, not the toolchain's

AGENTS.md

@@ -65,7 +65,8 @@ they never reach a consumer.
   `tsconfig.build.json` is that gate, typechecking the shipped files alone with `types: []` and
   `lib: ES2022`, so `node:fs`, `process` and an ES2024 method are compile errors here rather than a
   consumer's crash there. Node's test runner, the corpus reads and the build are the repo's own,
-  never the library's.
+  never the library's, and `engines.node` states the floor the shipped JavaScript needs — `>=18`,
+  the lowest line carrying ES2022 — never the higher one those repo-only tools want.
 - ESM only — no CommonJS build, no dual-package hazard.
 - One entrypoint: built JavaScript, `.d.ts` beside it. Do not add a TypeScript-source entrypoint —
   Node refuses to type-strip under `node_modules` (`ERR_UNSUPPORTED_NODE_MODULES_TYPE_STRIPPING`),

package.json

@@ -10,7 +10,7 @@
   },
   "type": "module",
   "engines": {
-    "node": ">=24"
+    "node": ">=18"
   },
   "scripts": {
     "test": "node --test --experimental-test-coverage --test-coverage-exclude=\"src/**/*.test.ts\" --test-coverage-branches=97 --test-coverage-functions=100 --test-coverage-lines=100 \"src/**/*.test.ts\"",

todo.md

@@ -145,8 +145,7 @@ numbering is the order the work was planned in, not the order it ships.
       maintainer's bump PR also removes `private: true`, the guard against any earlier publish.
       §6's browser half is first checkable here, on the emitted `dist/index.js` a browser can
       load — the compile gate names no host API, and a real page converting a document is the
-      other half. `engines` is settled here too: `>=24` is the toolchain's floor, not the ES2022
+      other half.
-      one the shipped JavaScript needs, and it reads to a consumer as the latter.
       **Settled** (the maintainer, 2026-09-01): the round-trip proved over the checked-in corpus
       is what `0.1.0` ships on, and the open-ended proof work follows it rather than gating it —
       3k's spec suite and 4's generators and maintainer-supplied payloads are `0.2.0`, 4b's retry