chore: raise the node floor to 22, make the libsodium step cross-platform and fail-loud, address dependency advisories

Regenerating the lockfile picked up a newer @cardano-sdk/crypto release that
dropped its errant npm-CLI runtime dependency, clearing the critical tar
advisory and 42 other advisories that traced back to it (44 -> 1, the
remainder a dev-only esbuild low). A defensive overrides pin on tar and
brace-expansion is retained per plan but is empirically not what resolved
this - documented honestly in README.md and the task report.

engines.node raised to >=22 everywhere (root + all three packages), matching
the CI workflow's node-version and the Dockerfile's node:22-alpine base
(both already agreed; no discrepancy to reconcile).

postinstall no longer symlinks libsodium with `ln -sf ... || true`, which
silently no-opped on Windows and left a runtime ERR_MODULE_NOT_FOUND.
scripts/link-libsodium.mjs copies the file cross-platform instead, logs one
line, and exits non-zero on genuine failure.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

package.json

@@ -5,7 +5,7 @@
   "type": "module",
   "workspaces": ["packages/*"],
   "scripts": {
-    "postinstall": "ln -sf ../../../libsodium-sumo/dist/modules-sumo-esm/libsodium-sumo.mjs node_modules/libsodium-wrappers-sumo/dist/modules-sumo-esm/libsodium-sumo.mjs 2>/dev/null || true",
+    "postinstall": "node scripts/link-libsodium.mjs",
     "clean": "rm -rf packages/*/build",
     "build": "npm run build --workspace=@apexfusion/vector-mcp-builder && npm run build --workspace=@apexfusion/vector-mcp-signer",
     "typecheck": "tsc --noEmit -p packages/shared && tsc --noEmit -p packages/builder && tsc --noEmit -p packages/signer",
@@ -24,8 +24,12 @@
     "tsx": "^4.21.0",
     "typescript": "^5.7.3"
   },
+  "overrides": {
+    "tar": "^7.5.21",
+    "brace-expansion": "^2.0.2"
+  },
   "engines": {
-    "node": ">=22.0.0"
+    "node": ">=22"
   },
   "license": "ISC",
   "author": "Apex Fusion",