Declare ESM mode in the temporary verification harness fixture

## Priority

P2 — focused reliability or product improvement

## Context

Portfolio audit follow-up (2026-09-08). The audit observed 137/138 tests passing on accepted Node 18. The failing harness copies ESM .js files into a temporary directory without its package/module declaration, so that runtime interprets scripts/fingerprint.js as CommonJS. This is a test-runtime compatibility defect.

## Starting points / evidence

Audited `test/harness.test.js:82-120`, `scripts/fingerprint.js`, and Node requirement in `scripts/verify.sh`. Reconfirm against the current branch before changing the supported runtime policy.

## Implementation scope

Make the temporary tree a valid ESM package by copying an appropriate package.json, using .mjs, or another explicit module declaration. Align the documented/package runtime contract and CI matrix; do not depend on newer runtimes silently inferring module syntax.

## Acceptance criteria

- [ ] The temporary harness fixture loads successfully on every declared supported runtime.
- [ ] The test still exercises the intended verification/fingerprint behavior after fixing module setup.
- [ ] Runtime requirements in package metadata, verification scripts and docs agree.
- [ ] The full relevant test suite passes; unsupported runtimes fail early with a clear requirement.

Keep the change focused on this issue. Use synthetic fixtures for sensitive data and mocked providers for automated tests; do not require paid model calls to run the regression suite.

Start with test/harness.test.js:82-120, scripts/fingerprint.js, and scripts/verify.sh, then inspect the package metadata and runtime documentation. Reconfirm the supported Node versions and CI matrix before choosing the module declaration approach. Done means the temporary fixture loads as ESM on every declared runtime, the verification behavior remains covered, and the relevant suite passes.

Written by the indexing model from the issue text.