Add pinned WPT and isolated Node test tooling

[jdalton]

Narrow this PR to development tooling. src/nwsapi.js is unchanged from master; selector fixes, legacy handling, optimizations, benchmarks and cross-feature regressions now have separate destinations.

Includes pinned WPT setup, a 41-page Chromium runner, independent Node tests, lint, minification and CI. Uses npm with a lockfile. Development guidance is Node.js ≥ 22 at a patch level supported by the dependencies; library runtime support is unchanged.

One commit, 22 changed files instead of 52, and 3,692 additions instead of 12,857. Of those additions, 1,625 are the npm lockfile.

Preservation

The exact previous head, bc704565c1bd14f1f22c285cc76d4e507687acaa, remains on archive/pr167-before-split. This is a split, not a reversal of the engine work.

Work moved out	Destination
Previously extracted selector/cache fixes	#178, #180, #182, #184–#194; merged fixes remain on master
Adaptive ancestor filtering	#189
Forgiving-list parsing	#199
Attribute equality	#200
Relative :has() anchoring	#201
Media/time handling and state-browser fixture/tests	#202
Legacy DOM handling, docs and host tests	#203
Compound negation	#204
Resolver execution	#205
Descendant routing	#206
Lazy hover tracking	#207
Benchmark harness, SVGs and historical reports	#208
All 46 cross-feature Node tests and four browser-agreement tests	#209

The focused PRs also carry their own regression tests. Media approximations, relational syntax/isolation gaps and legacy integration dependencies remain documented review work. #209 retains assertions that fail on master. Newer #195, #196 and #198 fixes were not in the archived aggregate and remain independent.

Historical browser-share/differential research, one-off extraction scripts and personal generated state remain in the exact archive; they are not build/test dependencies. The archived pnpm files are replaced here by the npm lock, not presented as runtime changes. No SVG charts or benchmark claims remain in this PR.

Validation

CI runs lint, Node tests, the build and WPT in one Node.js 26 job, with one dependency install and no version matrix. The tooling uses no Node APIs newer than 22; the prior Node 22 run passed. Development guidance and runtime support are unchanged.

The checkout and setup-node actions are pinned to verified full commit SHAs, with release-version and date comments.

Refreshed after #211 merged. On master 62d45eb, all 24 Node tests, lint, minification and checkout verification pass. All 41 WPT pages pass with the existing baseline unchanged. The Node suite now includes the 11 adapter tests. The source remains identical to master.

CI passes on 4246e28: one Node.js 26 job successfully runs lint, all 24 Node tests, minification, checkout verification and WPT using the SHA-pinned actions.

On tooling head ff9a27e: 13 Node tests, lint, minification, cleanup and checkout verification pass. All 41 selected WPT pages pass against the measured master baseline of 352 expected failures. That is 16 more than the archived aggregate's baseline; those cases belong to pending relative-:has() work in #201, not dropped regressions.

The checkout helper rejects paths resolving outside the repository and dirty checkouts before changing sparse patterns. Eight tests verify the safety guards with disposable repositories. The WPT validation used a fresh real checkout, not a symlink to another worktree.

All original factory-level declarations were accounted for against the successors, including deliberate corrections found during extraction. The four global adaptive-filter arrays/counters were replaced by resolver-owned state in #189. Separate integration validation is recorded below; it does not change this PR's source or baseline.

The reproducible integration checkpoint records inputs, conflict recipes and remaining gaps. Its original 64 Node tests, 27 runtime/matcher/reproduction checks, 81 focused checks, four Chromium agreement tests and five live-state browser scenarios pass, along with 16 additional cross-PR probes. It recorded nine TODOs; #198 now fixes the four escaped line-continuation cases with passing regressions. This is an audit branch, not another aggregate product PR; the other recorded gaps still need review.