Stop quoting the Node version in prose, and correct the bare-vp claim

#402 moved `.node-version` to 26.8.1 and Renovate has 26.8.2 queued
already. Three places named a Node version that Renovate never edits:
README.md, CLAUDE.md, and the comment above `setup-node` in verify.yml.
Updating the number would just reset the clock - the file has moved four
times since 2026-07-01 (26.5.1, 26.7.0, 26.8.1, 26.8.2 queued).

So these now point at `.node-version` instead of naming a version. That
is the convention this repo already documents for two other pins: "Do
not quote that pin here, read it with `grep channel rust-toolchain.toml`"
(which named 1.97.1 for weeks after #316 moved it) and "Do not quote a
byte count for `engine.wasm` from this file." `.node-version` is the
same class and never got the same treatment.

`docs/bun-deno-evaluation.md` keeps its 26.7.0 deliberately: it records
the conditions a past measurement ran under, so rewriting it would
falsify the record rather than update it.

Separately, the README claimed a bare `vp` fails with `EBADDEVENGINES`.
It does not - measured here, `vp check` (v0.3.1) exits 0 and reports all
281 files formatted. Only `npx vp` fails. CLAUDE.md already carries that
correction from 2026-08-04 and warns against "fixing" a working command
on the strength of the old claim; the README never got it.

Verified on 26.8.1 before merging #402: full `pnpm run verify` exit 0,
with `vp cache clean` first so the cached test phase could not replay a
26.7.0 result.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TSoJPryVM4vP3uB2iXeV2X

Author: wormeyman

.github/workflows/verify.yml

@@ -167,7 +167,7 @@ jobs:
       # store path by running pnpm, so pnpm has to be on PATH already.
       - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
 
-      # `.node-version` (26.7.0) is the single source of truth for the Node
+      # `.node-version` is the single source of truth for the Node
       # version, and this is its first real consumer - the file went from
       # documentation to machinery when this workflow landed. `engines.node`
       # stays a permissive floor and is deliberately NOT what CI runs.

CLAUDE.md

@@ -186,9 +186,14 @@ the scripts and CI use and so the one that stays verified; just don't expect a
 bare `vp` to fail, and don't "fix" a working command on the strength of this
 note.
 
-Node **26.7.0** (`.node-version`) is what the repo is developed and verified on.
-`engines.node` stays a permissive floor (`>=24.18.0`) rather than matching the
-pin - older versions are simply untested, not known-broken.
+`.node-version` is the Node version the repo is developed and verified on.
+**Do not quote that pin here** - read it with `cat .node-version`. Renovate
+bumps that file on its own and has moved it four times since 2026-07-01
+(26.5.1, 26.7.0, 26.8.1, with 26.8.2 queued as of 2026-09-11), so a number
+written here can only ever lag it - the same trap `rust-toolchain.toml` and the
+`engine.wasm` byte count already carry warnings about. `engines.node` stays a
+permissive floor (`>=24.18.0`) rather than matching the pin - older versions
+are simply untested, not known-broken.
 
 **`.node-version` is machinery now, not documentation.** That changed when
 `.github/workflows/verify.yml` landed: `actions/setup-node` reads the file via

README.md

@@ -75,11 +75,12 @@ docs).
 
 ## Development
 
-Built and verified on Node **26.7.0** (`.node-version`, which is also what CI
-installs); `engines.node` is a permissive floor of `>=24.18.0` because older
-versions are untested rather than known-broken. The project pins pnpm via
-`devEngines`, so run `vp` through pnpm (a bare `vp` or `npx vp` from the project
-root fails with `EBADDEVENGINES`).
+Built and verified on the Node version in `.node-version`, which is also what
+CI installs - read it with `cat .node-version` rather than trusting a number
+written here. `engines.node` is a permissive floor of `>=24.18.0` because
+older versions are untested rather than known-broken. The project pins pnpm via
+`devEngines`, so run `vp` through pnpm - that is the form `package.json` and CI
+use. `npx vp` fails with `EBADDEVENGINES`; a bare `vp` does not, it runs fine.
 
 - `pnpm install` - install dependencies
 - `pnpm vp dev` - dev server