ci(root): align node versions across release and ci

Keep the compatibility matrix on explicit Node.js major lines.
Use .nvmrc for the release gate and single-version CI jobs and cache keys.

TICKET: WCN-2596

Author: zahin-mohammad

.github/workflows/ci.yml

@@ -205,10 +205,10 @@ jobs:
         with:
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
 
-      - name: Setup node 22
+      - name: Setup node from .nvmrc
         uses: actions/setup-node@v6
         with:
-          node-version: 22
+          node-version-file: .nvmrc
 
       - name: restore lerna dependencies
         id: lerna-cache
@@ -217,7 +217,7 @@ jobs:
           path: |
             node_modules
             modules/*/node_modules
-          key: ${{ runner.os }}-node22-${{ hashFiles('yarn.lock') }}-${{ hashFiles('tsconfig.packages.json') }}-${{ hashFiles('**/package.json') }}
+          key: ${{ runner.os }}-node${{ hashFiles('.nvmrc') }}-${{ hashFiles('yarn.lock') }}-${{ hashFiles('tsconfig.packages.json') }}-${{ hashFiles('**/package.json') }}
 
       - name: Install Packages
         if: steps.lerna-cache.outputs.cache-hit != 'true' || contains( github.event.pull_request.labels.*.name, 'SKIP_CACHE')
@@ -262,10 +262,10 @@ jobs:
         with:
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
 
-      - name: Setup node 22
+      - name: Setup node from .nvmrc
         uses: actions/setup-node@v6
         with:
-          node-version: 22 # this just needs to pass our lock file requirement for compilation
+          node-version-file: .nvmrc
 
       - name: Build Info
         run: |
@@ -458,10 +458,10 @@ jobs:
         with:
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
 
-      - name: Setup node 22
+      - name: Setup node from .nvmrc
         uses: actions/setup-node@v6
         with:
-          node-version: 22
+          node-version-file: .nvmrc
 
       - name: restore lerna dependencies
         id: lerna-cache
@@ -470,7 +470,7 @@ jobs:
           path: |
             node_modules
             modules/*/node_modules
-          key: ${{ runner.os }}-node22-${{ hashFiles('yarn.lock') }}-${{ hashFiles('tsconfig.packages.json')}}-${{ hashFiles('**/package.json') }}
+          key: ${{ runner.os }}-node${{ hashFiles('.nvmrc') }}-${{ hashFiles('yarn.lock') }}-${{ hashFiles('tsconfig.packages.json')}}-${{ hashFiles('**/package.json') }}
 
       - name: Install Packages
         if: steps.lerna-cache.outputs.cache-hit != 'true' || contains( github.event.pull_request.labels.*.name, 'SKIP_CACHE')

.github/workflows/npmjs-release.yml

@@ -308,12 +308,13 @@ jobs:
           NPM_CONFIG_PROVENANCE: true
 
       # WCN-2091: fail the release BEFORE bitgo publishes if the shrinkwrap it
-      # would ship pins any transitive that violates our declared engines (Node
-      # >=20). Runs after pass 1 because the shrinkwrap generator resolves
-      # newly-published siblings from the registry. Pack + install here, not
-      # --package-lock-only, so `engine-strict=true` actually validates every
-      # frozen entry's engines. If this fails, siblings are already on npm but
-      # bitgo isn't — fix the shrinkwrap issue and re-run in recovery-mode.
+      # would ship pins any transitive that is incompatible with the Node.js
+      # version pinned in .nvmrc. Runs after pass 1 because the shrinkwrap
+      # generator resolves newly-published siblings from the registry. Pack +
+      # install here, not --package-lock-only, so `engine-strict=true` actually
+      # validates every frozen entry's engines. If this fails, siblings are
+      # already on npm but bitgo isn't — fix the shrinkwrap issue and re-run in
+      # recovery-mode.
       - name: Pre-publish shrinkwrap check — pack bitgo tarball
         if: inputs.dry-run == false
         env:
@@ -325,13 +326,13 @@ jobs:
           echo "PREPUB_TARBALL=$tarball" >> "$GITHUB_ENV"
           echo "Packed: $tarball"
 
-      - name: Pre-publish shrinkwrap check — setup Node 20
+      - name: Pre-publish shrinkwrap check — setup Node.js from .nvmrc
         if: inputs.dry-run == false
         uses: actions/setup-node@v6
         with:
-          node-version: '20.x'
+          node-version-file: '.nvmrc'
 
-      - name: Pre-publish shrinkwrap check — install tarball on Node 20 with engine-strict
+      - name: Pre-publish shrinkwrap check — install tarball on repository Node.js with engine-strict
         if: inputs.dry-run == false
         run: |
           workdir="$(mktemp -d)"
@@ -340,18 +341,12 @@ jobs:
           npm init -y >/dev/null
           echo "Verifying $PREPUB_TARBALL installs on $(node --version) with engine-strict=true"
           if ! npm install "$PREPUB_TARBALL" --no-audit --no-fund --ignore-scripts 2>install.log; then
-            echo "::error::Pre-publish shrinkwrap check FAILED — bitgo tarball cannot be installed on Node 20 with engine-strict. Fix before publishing."
+            echo "::error::Pre-publish shrinkwrap check FAILED — bitgo tarball cannot be installed on the repository Node.js version with engine-strict. Fix before publishing."
             cat install.log
             exit 1
           fi
           echo "✅ bitgo tarball installs cleanly on $(node --version) with engine-strict."
 
-      - name: Pre-publish shrinkwrap check — restore release Node version
-        if: inputs.dry-run == false
-        uses: actions/setup-node@v6
-        with:
-          node-version-file: ".nvmrc"
-
       - name: Publish bitgo (pass 2)
         if: inputs.dry-run == false
         run: |