👷 Type-check the TS floor in CI

Add a `compat` job that type-checks the whole suite and a consumer fixture
against the minimum supported TypeScript (5.9), reusing the `dist/` artifact
`build` produced and gating `publish`. The compiler is resolved by npx, so it
never enters `devDependencies` or the local `check`/`verify` loop.

The fixture imports the package by name, resolving the emitted declarations
through the `exports` map; `expectTypeOf` / `.not.toBeAny()` make it reject an
`any`-typed declaration, which a bare compile would accept.

Correct the README consumer floor from >= 5.0 to >= 5.9 (set by `type-fest`)
and drop the `node10` resolution claim, which the exports-only entry never
satisfied.

CONTRIBUTING.md

@@ -20,6 +20,9 @@ the rules so agents and humans don't diverge.
 
 - **Build:** `npm run build`
 - **Test:** `npm run test`, `npm run test:ci`
+- **Compat (CI-only):** `npm run test:compat` — type-check the suite + a consumer
+  fixture against the minimum supported TypeScript; needs a built `dist/` and
+  network access (`npx`)
 - **Watch:** `npm run watch` - re-runs tests on file save, humans only
 - **Checks:** `npm run check`, `npm run fix`
 - **Doc tests:** `npm run create:doc-tests` — compile the `ts`-tagged fences
@@ -44,6 +47,7 @@ faster tiers catch less, slower tiers are more thorough":
 | `npm run fix`                    | manual                  | Auto-resolve fixable issues (lint, format)                                                                                                              | ~3s   |
 | `npm run maintain`               | manual / CI (advisory)  | `maintain:knip` + `maintain:outdated` (whole-project + network scans)                                                                                   | ~10s  |
 | CI build (auto)                  | on push to `main` / tag | `build` job (build + correctness + coverage + packaging) — see [.gitea/workflows/ci.yml](./.gitea/workflows/ci.yml)                                     | ~30s+ |
+| CI compat (auto)                 | on push to `main` / tag | `compat` job — `test:compat` over the built `dist/`; gates `publish` — see [compat/](./compat)                                                          | ~15s  |
 | CI maintain (auto, non-blocking) | on push to `main`       | `npm run maintain` — reports, never fails the build                                                                                                     | ~10s  |
 | CI publish (auto)                | on tag                  | packaging checks + `publish:publint` / `publish:attw`, then the Gitea release page and `npm publish` (skipped, and the job failed, without `NPM_TOKEN`) | ~15s  |
 
@@ -142,7 +146,9 @@ CI step. Pick the prefix that matches the script's lifecycle:
   unit tests); `test:unit` skips the typecheck for fast local iteration;
   `test:coverage` runs c8 over the hand-written tests only; `test:doc` runs the
   generated doc examples without coverage; `test:ci` chains the two and fails
-  below 100% coverage on `src/` (CI-only; `verify` stays coverage-free).
+  below 100% coverage on `src/`; `test:compat` type-checks the suite + a
+  consumer fixture against the minimum supported TypeScript via `npx` (both
+  CI-only; `verify` stays coverage- and network-free).
 - `watch:*` — long-running watchers for the manual inner dev loop. Aggregated by
   `watch`.
 - `maintain:*` — advisory repo-maintenance scans: read-only, but whole-project