test: harden release and browser gates

.github/workflows/ci.yml

@@ -47,6 +47,36 @@ jobs:
       - name: Run verification suite
         run: npm run verify
 
+  node20:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+
+      - name: Set up lowest supported Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: '20.19.0'
+          cache: 'npm'
+          cache-dependency-path: |
+            package-lock.json
+            server/package-lock.json
+
+      - name: Install root dependencies
+        run: npm ci
+
+      - name: Install server dependencies
+        run: npm ci
+        working-directory: server
+
+      - name: Run unit and relay integration gates
+        run: |
+          npm run test:coverage
+          node scripts/test-server-routes.mjs
+          node scripts/test-server-ws.mjs
+        env:
+          ADMIN_METRICS_TOKEN: verify-admin-token-with-more-than-32-chars
+
   e2e:
     # Kept separate from `verify`: this job needs a downloaded browser, so a
     # failure here should read as "the browser flow broke", not as a broken
@@ -66,6 +96,10 @@ jobs:
       - name: Install root dependencies
         run: npm ci
 
+      - name: Install server dependencies
+        run: npm ci
+        working-directory: server
+
       - name: Install Playwright browsers
         run: npx playwright install --with-deps chromium chromium-headless-shell firefox webkit
 
@@ -75,3 +109,14 @@ jobs:
 
       - name: Run cross-browser detection and extension E2E tests
         run: npm run test:e2e
+
+      - name: Upload browser failure diagnostics
+        if: failure()
+        uses: actions/upload-artifact@v7
+        with:
+          name: e2e-failure-diagnostics
+          path: |
+            test-results/
+            playwright-report/
+          if-no-files-found: error
+          retention-days: 14