Raise Node floor to 22, test on 24

[francoisferrand]

Node 20 went EOL in April 2026, so engines.node: ">=20" was advertising a runtime nobody tests. No functional effect — everything we run on already satisfies >=20 — it just stops the manifest claiming a dead runtime.

Deliberately >=22 and not >=24: Arsenal and backbeat consume this library and are still on 22, so going straight to 24 would break their installs. It can drop to >=24 once they've moved, or when 22 goes EOL in April 2027.

CI now runs a 22/24 matrix instead of a single pinned 22, so we're actually testing the runtime we're heading for.

While in here I refreshed yarn.lock, which had drifted a long way behind — js-yaml, brace-expansion, flatted and @humanfs/node were all held at versions with published advisories, three of them high. Every fix was already inside the ranges we declare, so it's lockfile-only and pulls in no new majors. Takes the audit from 10 findings down to 3.

The remaining 3 can't be fixed here. The eslint-config-scality "malware" critical is a false positive: we resolve it from GitHub over git+, not from the registry where the name is squatted. markdown-it and linkify-it come from exact pins inside Guidelines and need fixing there.

Going out as 1.1.1 rather than 1.2.0 — no runtime source has changed since 1.1.0, consumers pin by git ref so nothing auto-resolves, and the agentkeepalive range bump resolves to the same version either way.

Issue: ARSN-642