Vitest 5 업그레이드, Node 22 CI 마이그레이션 및 lockfile 감사

I can't carry out this upgrade in your repo — I don't have access to your filesystem, `node_modules`, lockfile, or CI configuration, and I can't run `npm`, `npx vitest`, or `grep` against your checkout. Anything I "reported" about your actual `engines.node` range, lockfile diffs, or test counts would be fabricated.

What I can do is give you a precise, runnable plan that matches your eight steps, with the exact commands and the decision points where you'll need to fill in real values from your repo.

## Step-by-step plan

**1. Get vitest 5's `engines.node`**
```bash
node -p "require('./node_modules/vitest/package.json').engines"
# or, if not installed yet:
npm view vitest@5 engines --json
```
Record the range (e.g. `^20.0.0 || >=22.0.0` — verify, don't assume).

**2. Bump `package.json`**
- Set `devDependencies.vitest` to the v5 range you intend to pin.
- Add `engines.node` set to the **strictest floor** across all deps. Find it with:
```bash
node -e '
const l=require("./package-lock.json");
const floors=[];
for (const [k,v] of Object.entries(l.packages||{})) {
  if (v.engines && v.engines.node) floors.push([k, v.engines.node]);
}
floors.sort((a,b)=>a[1].localeCompare(b[1]));
console.log(floors.slice(0,20));
'
```
Pick the highest minimum major that satisfies every entry (usually driven by vitest, `vite`, or `@types/node`).

**3. Regenerate lockfile**
```bash
npx npm@11 install --package-lock-only --ignore-scripts
```

**4. Find test-running workflows**
```bash
grep -rnE 'vitest|npm test|npm run test|npx vitest' .github scripts package.json
```
For each hit inside `.github/workflows/*.yml`, bump **only that job's** `node-version` to `22`. Leave unrelated jobs alone.

**5. Compare test runs across Node majors**
```bash
# old major (e.g. 20)
nvm use 20 && npx vitest run --reporter=verbose 2>&1 | tee /tmp/vitest-node20.log
# new major
nvm use 22 && npx vitest run --reporter=verbose 2>&1 | tee /tmp/vitest-node22.log
# diff the summary lines
grep -E 'Test Files|Tests ' /tmp/vitest-node20.log /tmp/vitest-node22.log
```
File/test counts should match; investigate any delta before merging.

**6. Replay the CI job's other steps**
Read the workflow YAML and run, in order, with the same `env:` block:
```bash
# e.g.
npm run guardrails
npm run typecheck
npm run lint
npm run build
```
Copy any `env:` keys from the workflow into your shell (`export FOO=...`) so behavior matches.

**7. Confirm no ERESOLVE**
```bash
npm ci --ignore-scripts
npm ci --legacy-peer-deps --ignore-scripts
```
Both must exit 0. If the first fails with ERESOLVE, that's a real peer conflict to resolve in `package.json`, not something to paper over with `--legacy-peer-deps`.

**8. Enumerate lockfile changes**
```bash
git diff -- package-lock.json > /tmp/lock.diff
# list changed package names
git diff -- package-lock.json | grep -E '^\+.*"node_modules/' | sed -E 's/.*"node_modules\/([^"]+)".*/\1/' | sort -u
```
Classify each entry:
- **vitest's own deps**: `vitest`, `@vitest/*`, `vite`, `vite-node`, `tinypool`, `tinybench`, `@vitest/expect`, `@vitest/runner`, `@vitest/snapshot`, `@vitest/spy`, `@vitest/utils`, `chai`, `expect-type`, `why-is-node-running`, `pathe`, `std-env`, `debug`, `magic-string`, `postcss`, `rollup`, `esbuild`, `picocolors`, `sirv`, `source-map-js`, `nanoid`, `fdir`, `tinyglobby`, `@rollup/*`, `@esbuild/*`.
- **unrelated drift**: anything else — flag it and consider whether it belongs in this PR.

## Owner action items (things I can't verify)

- **Hosting provider Node version** (Vercel/Netlify/Render/Fly/etc.): check the dashboard or `vercel.json` / `netlify.toml` / `fly.toml` / `render.yaml` for a pinned Node major and align it with `engines.node`.
- **`packageManager` field** in `package.json`: confirm it matches the `npm@11` you used to regenerate the lock.
- **CI matrix jobs** that don't run tests but still install deps: they may need the Node bump too if `engines.node` is enforced (`engine-strict=true` in `.npmrc`).
- **`engines.node` enforcement**: check `.npmrc` for `engine-strict`; if absent, the field is advisory only.
- **Actual test counts** on Node 20 vs 22: I can't run them — you'll need to paste the two `--reporter=verbose` summaries if you want me to help interpret a delta.
- **Lockfile diff classification**: paste the output of the step-8 command and I'll sort it into "vitest's own" vs "unrelated drift" for you.

If you paste the outputs of steps 1, 4, 5, and 8, I can do the analysis and write the PR description.