chore: upgrade to NPM v12

[coderbyheart]

Require npm >=12.0.2 <13 for this project. The Node.js requirement is left unchanged. It is enforced via
check-node-version from the prepare script.

Why

npm v12 turns three code-execution paths off by default — most notably the
unauthorized execution of install scripts, which is the primary vector for
supply-chain attacks via compromised dependencies
(GitHub changelog):

• allowScripts now defaults to off, so npm install no longer executes
  preinstall, install or postinstall scripts from dependencies unless they
  are explicitly allowed in package.json. This also covers prepare scripts
  from git, file and link dependencies.
• --allow-git now defaults to none, which closes a code-execution path
  where a git dependency's .npmrc could override the git executable, even with
  --ignore-scripts.
• --allow-remote now defaults to none, blocking dependencies from remote
  URLs such as HTTPS tarballs.

Pinning engines.npm to >=12.0.2 <13 and failing the install when it is not
met means these protections cannot be silently bypassed by running an older npm
locally or in CI.

How

• engines.npm is set to >=12.0.2 <13. engines.node is left untouched.
• check-node-version --package runs from the prepare script, which npm
  executes on npm install and npm ci.
• No workflow changes were needed: this repository has no actions/setup-node
  step that installs dependencies with npm.

Note on the package-lock.json diff

npm 12 rewrites this lock file from lockfileVersion 1 to
3, so the diff is large. This is a format migration, not a dependency
update: 933 already-locked packages keep byte-identical versions, the only
additions are check-node-version and its transitive dependencies.

The rewrite is unavoidable — the first npm install on npm 12 produces it either
way — so it is included here rather than left to land unreviewed later.