chore: release 4.0.0 — drop Node <22 support

[Dixter999]

Release v4.0.0 prep. Implements #686 — drops Node 16/18/20 support, aligns with active LTS (Node 22/24).

What changed

Surface	Before	After
Root engines.node	>=16.0.0	>=22.0.0
Root engines.npm	>=8.0.0	>=10.0.0
14 plugin engines.node	>=18.0.0	>=22.0.0
CI test matrix	[18.x, 20.x]	[22.x, 24.x]
Single-Node workflows	'20'	'22' (4 workflows)
plugin-publish.yml	'24'	unchanged (already modern)
Root version	3.25.7	4.0.0
Plugin versions	3.13.x	4.0.0 (plugin-obsidian: 1.0.0 → 2.0.0)
package-lock.json	npm 8/9 format	regenerated with npm 10

Why

• Node 18 EOL: 2025-04-30 (14 months ago)
• Node 20 EOL: 2026-04-30 (2 months ago)
• Both versions our CI matrix tested were already past upstream end-of-life
• Three dependabot PRs in one week (deps-dev(deps-dev): bump eslint from 9.39.4 to 10.5.0 #683 eslint@10, deps-dev(deps-dev): bump @eslint/js from 9.39.4 to 10.0.1 #684 @eslint/js@10, deps(deps): bump which from 5.0.0 to 7.0.0 #685 which@7) all closed for the same Node-floor mismatch — pattern was structural, not transient
• Active LTS targets: Node 22 (until 2027-04-30), Node 24 (until 2028)

Compatibility scan

Source tree grepped for known-removed/deprecated Node APIs:

• util.isArray — none
• new Buffer(...) constructor — none
• process.binding(...) — none
• punycode builtin — none

No Node 22+ landmines found. Real proof comes from CI on this PR (matrix runs on 22.x and 24.x now).

Migration notes for users

• On Node 22+: npm install -g claude-autopm@4 works unchanged.
• On Node 16/18/20: upgrade Node (nvm install 22 && nvm use 22) before upgrading. v3.25.7 stays on npm for the lagging tail; no patches will be backported.
• The three closed dependabot PRs (deps-dev(deps-dev): bump eslint from 9.39.4 to 10.5.0 #683, deps-dev(deps-dev): bump @eslint/js from 9.39.4 to 10.0.1 #684, deps(deps): bump which from 5.0.0 to 7.0.0 #685) will be regenerated by dependabot automatically — they should merge cleanly against v4.

Promotion path

This PR lands on develop. After it merges + CI is green, open a separate Release: v4.0.0 (promote develop → main) PR with head = develop (the Enforce main source gate only allows promotion from a branch literally named develop). After main merge, tag v4.0.0 to trigger npm publish.

Test plan

• CI green on Node 22.x
• CI green on Node 24.x
• Plugin-core script sync passes
• Commands sync check passes
• Verify PR source is develop skips (PR targets develop, not main)
• After merge: smoke-test npm install -g claude-autopm@4 from a fresh shell on Node 22

Closes #686.

[github-actions]

✅ Approved

🤖 Claude Sonnet 4.6 (OpenRouter) (anthropic/claude-sonnet-4.6) via OpenRouter

This is a clean semver-major release PR that raises the Node.js engine floor from >=16 to >=22, bumps all 14 plugin packages to 4.0.0, updates CI matrices from [18.x, 20.x] to [22.x, 24.x], regenerates package-lock.json with npm 10, and adds a CHANGELOG entry. The diff is purely mechanical version/engine metadata changes with no logic, security surface, or framework payload modifications.

1 finding:

• 🟡 MEDIUM CONFIDENCE package.json:14 — The postinstall script emoji was changed from a literal 🎉 to escaped Unicode surrogate pairs (\ud83c\udf89), which is the UTF-16 encoding of 🎉. In a JSON file this is technically valid but unusual; if the file is not saved as UTF-8 or is processed by a tool that interprets the escape sequences literally, the output could render as the raw escape sequences rather than the emoji. The original literal emoji is the safer and more conventional form.
  • Fix: Revert to the literal emoji character 🎉 in the postinstall echo string, consistent with the prior value.
  • Evidence: '- "postinstall": "echo '🎉 ClaudeAutoPM installed! Run: autopm --help'",' → '+ "postinstall": "echo '\ud83c\udf89 ClaudeAutoPM installed! Run: autopm --help'",'

---

Gate wrong or a false positive? Do not edit this workflow to pass — open an issue on lagowski/pr-review-gate.