ci: test Node 18 with a smoke test of the built artifact, not with a runner that refuses it

[Rome-1]

Unblocks #237's last failure. The shipped code is unchanged — this is a CI-matrix fix.

The question, and the answer

cross-platform (ubuntu-latest, 18) failed on verify-hook-liveness — expected null to be 'deny'. That probe is rf-fuwy, so it mattered whether the probe fails on Node 18 or only the test. Measured on a real Node 18.20.8:

	Node 18.20.8	Node 24.14.0
shipped dist, exported runConfiguredHook, 200 iterations	200/200 read deny	200/200
raw spawnSync call, no vitest, no TS, 350 each	0 failures	0 failures
built CLI node ./dist/index.js --version	0.10.1	—
the failing test file, in isolation	4/4 pass	—

The probe does not fail on Node 18. The cause is structural:

vitest 4.1.0   engines.node = ^20.0.0 || ^22.0.0 || >=24.0.0
matrix         node: ["18", "20", "22"]

vitest 4 does not run on Node 18. That leg ran the full 2194-test suite on a runner that declares it will not run there — which is why 18 alone failed, and why it failed intermittently (89 of 90 files passed).

What changes

engines stays >=18 — the shipped code works there, measured. What was dishonest is a matrix leg claiming to test Node 18 while running a runner that refuses it. So 18 leaves the vitest matrix and is replaced by node18-smoke: build on 20, run on 18, which is the user's situation since they install a prebuilt package rather than compiling one.

The smoke asserts the rf-fuwy probe both ways — a live gate yields its decision, an inert one yields none.

Mutation-checked, including my own first attempt

• blank the live fixture → FAIL: probe read null, expected "deny"
• make the inert fixture work → FAIL: an inert gate was not reported inert

My first mutation attempt was itself vacuous: the mutants exited 1 on a module-not-found rather than on the assertion. These run in-tree so the import resolves and the failure is the real one.

Gated on run_core rather than the run that gated cross-platform — run_core is true on every PR, and a skipped job satisfies a required check.

Not reproduced, stated rather than glossed

I could not make the probe miss once in 900 attempts at load 12–16, so I can't name the exact CI mechanism. It's consistent with all three spawn attempts exhausting on a 2-core runner under a full-suite fork storm. The residual's direction is the safe one: a miss reports a live gate as dead, never a dead gate as live.

[Rome-1]

Superseded by #240. This branch could not be force-pushed after 5409a84 landed the matrix change directly on main, so it was reopened as a fresh rebased branch rather than rewritten. #240 carries the same two files — the node18-smoke job and the probe script — with the now-redundant matrix edit dropped. Verified there on a real v18.20.8 runtime, asserting both directions (live gate -> deny, inert gate -> no decision, status 127).