chore: add CI workflow and update roadmap

Runs typecheck/lint/lint:comments/format:check/test/test:visual on
every push and PR via GitHub Actions -- free and unlimited for this
public repo. Pins Node via .nvmrc + package.json engines so CI and
local dev stay on the same version.

docs/roadmap.md: mark the remaining "Not yet supported" gaps
(<mask>, filter) as blocked on external constraints rather than
open work, and add a spec-audit pass before npm publish.

Author: alfikiafan

.github/workflows/ci.yml

@@ -0,0 +1,29 @@
+name: CI
+
+on:
+    push:
+        branches: [main]
+    pull_request:
+
+permissions:
+    contents: read
+
+jobs:
+    ci:
+        runs-on: ubuntu-latest
+        steps:
+            - uses: actions/checkout@v7
+
+            - uses: actions/setup-node@v7
+              with:
+                  node-version-file: '.nvmrc'
+                  cache: 'npm'
+
+            - run: npm ci
+
+            - run: npm run typecheck
+            - run: npm run lint
+            - run: npm run lint:comments
+            - run: npm run format:check
+            - run: npm run test
+            - run: npm run test:visual

.nvmrc

@@ -0,0 +1 @@
+24

docs/roadmap.md

@@ -4,10 +4,14 @@
 
 Not just "worker-safe" — every package should run in all three environments. Any new adapter should be designed against this requirement from the start, not patched in afterward.
 
-## Feature gaps to close
+## Feature gaps
 
-See `docs/supported-features.md`'s "Not yet supported" list.
+`<mask>` and `filter="url(#...)"` (see `docs/supported-features.md`'s "Not yet supported" list) are both blocked on external constraints, not svg-pdf's own work — `<mask>` needs `@libpdf/core` to expose soft-mask support first, and `filter` is a hard PDF-format limitation. Nothing actionable remains here for now.
+
+## Before npm publish: spec audit
+
+Go feature-by-feature through `docs/supported-features.md`'s "Supported" list, checking each one against the relevant SVG2/PDF spec section plus its existing tests/fixtures — re-verifying what's already claimed as supported, not searching for net-new features. (A full read of the SVG2/PDF specs from scratch is out of scope; that's a much bigger, open-ended effort than this project needs right now.)
 
 ## After that
 
-CI, npm publish.
+npm publish.

package.json

@@ -2,6 +2,9 @@
     "name": "svg-pdf",
     "private": true,
     "type": "module",
+    "engines": {
+        "node": ">=24"
+    },
     "workspaces": [
         "packages/*"
     ],