revert: roll back Node 26 / npm 12 toolchain stack (#76459, #76306, #76295, #75037)

[teknium1]

Summary

Reverts the Node-26 / npm-12 toolchain stack that broke every installer and updater surface tonight (GUI installer, GUI updater, hermes update, nix), returning the toolchain floors to where they were: engines.node >=20, no engines.npm pin, no engine-strict, Node target major 22. System Node 22 / npm 10.x installs work again.

Reverted, newest first (per emozilla/ethernet's call):

• fix(runtime): managed Node/uv resolve first everywhere; require Node 26 #76459 — managed Node/uv resolve-first + Node 26 floor across installers/heal/upgrade (merge commit 85c8956ec7, includes 713a983e4a)
• fix(nix): use npm 12, fix ui package version #76306 — npm 12 + @nousresearch/ui pin + nix npm-12 tooling (f88ed6c717)
• fix(nix): update electron headers sha #76295 — nix electron headers sha (d5e135a513)
• fix(sec): patch vulnerable deps + add publication-age floors and npm script allow-list #75037 — sec sweep that introduced engine-strict, min-release-age, and the npm engine pin (merge commit 6ecd335aa8)

Deliberately KEPT: the EBADENGINE recovery machinery from #76464 (hermes_cli/npm_engine.py, bootstrap_hermes_managed_node(), tests) — it originated in #75037's lineage but is floor-agnostic: it reads the required range from npm's own error output, so it stays dormant while no pin exists and works unchanged if/when the npm-12 migration is re-attempted with an installer-first rollout.

Conflict resolutions

All resolved to the pre-PR state (<mergeSha>^): package.json / website/package.json engines, apps/desktop/package.json deps, both lockfiles, uv.lock, backend-env.test.ts (later fmt commit touched it). hermes_cli/main.py kept the #76464 call sites (they no-op without an engine failure).

Validation

	Broken (main)	After revert
engines	node >=26, npm >=11.17 (nonexistent npm version), engine-strict	node >=20, no npm pin, no engine-strict
system Node 22 / npm 10.x	EBADENGINE on every npm command	works
managed Node 22 trees	unfixable loop	valid again
nix npm-12 overlay	present	removed

124 targeted tests green (test_npm_engine.py, test_cmd_update.py, test_hermes_constants.py, test_web_ui_build.py, test_gui_command.py, test_desktop_exe_integrity.py); hermes_constants + npm_engine real-import check passes; no residue (nix/npm-12-0-2.nix, nix/node-gyp-11-4-0.nix, .npmrc, website/.npmrc all gone).

Infographic

[github-actions]

૮ >ﻌ< ა ci review

_{ran on 6a9c035}

❌ Job failures

Python tests / Run tests slice 4/8 · View job

Job Python tests / Run tests slice 4/8 failed.

---

⚠️ Action required

CI-sensitive file review · View job

This PR changes CI-sensitive files (eslint config, workflow YAMLs, or composite actions). These influence what the js-autofix job executes and pushes to main.

Sensitive files changed:

• .github/workflows/deploy-site.yml
• .github/workflows/docs-site-checks.yml
• .github/workflows/e2e-desktop.yml
• .github/workflows/js-autofix.yml
• .github/workflows/js-tests.yml
• eslint.config.shared.mjs

How to fix:

Add the ci-reviewed label after verifying:

• no new eslint rules with custom fix functions that write outside linted paths,
• no workflow changes that widen permissions or remove guards,
• no composite action changes that alter what gets executed.

---

ℹ️ Info

Desktop E2E visual evidence · View test artifacts · View job

3 visual diffs.

_{inline evidence upload failed.}

Failed to upload diff-1508682a2ae8-boot-ready-diff.png with gh image (exit code 1): Error uploading /home/runner/work/_temp/e2e-evidence/diff-1508682a2ae8-boot-ready-diff.png: step 0 (get upload token): uploadToken not found on repo page — do you have write access to NousResearch/hermes-agent? (or, if NousResearch enforces SAML SSO, authorize at https://github.com/orgs/NousResearch/sso)

[teknium1]

Superseded by #76562, which landed the forward fix instead: satisfiable engine floors (npm <11.10.0 || >=11.17.0, node >=20, toolchain target 22) while keeping #75037's vulnerability patches and adding invariant tests so an unsatisfiable floor can't recur. The full rollback is no longer needed.