- Widen engines range to >=24 <27
- Test against Node 24 and 26 in CI (build/deploy artefacts remain on 24)
- Replace unmaintained 'cbor' dependency with 'cbor2': the cbor package's
synchronous encode relies on a single stream read() returning the whole
encoding, which breaks on Node 26 where readable streams return one
buffer at a time
- Remove stale dependabot ignore for the removed cbor package
- Update Node.js support notes in README and AGENTS
