ci: test on macOS and Node 24

The matrix covered ubuntu with Node 20 and 22, which leaves two gaps.

Node 24 is the active LTS; 20 reached end of life in April 2026 and 22 is in
maintenance. So the versions being tested were a dead one and a maintenance
one, with the release itself published from 22. 24 is added rather than
dropping 20, since engines still allows it.

More significantly, seven test files contain darwin-gated paths that have
never run in CI - ios-project-service, ios-device-debug-service,
debug-controller, xcode-select-service, ios-simulator-discovery, host-info
and devices-service. On a CLI whose main job is building iOS apps, that was
the untested part, and it is the source of the 13-test gap between the local
and CI counts.

One macOS leg on the LTS covers those without a full cross-product; runners
are free on a public repo but the queue time is not. harden-runner only
supports the Ubuntu runners, so it is now conditional.

Author: edusperoni

.github/workflows/tests.yml

@@ -14,17 +14,26 @@ concurrency:
 
 jobs:
   test:
-    name: Test (Node ${{ matrix.node-version }})
-    runs-on: ubuntu-latest
+    name: Test (${{ matrix.os }}, Node ${{ matrix.node-version }})
+    runs-on: ${{ matrix.os }}
 
     strategy:
       fail-fast: false
       matrix:
-        node-version: [ '20.x', '22.x' ]
+        os: [ ubuntu-latest ]
+        node-version: [ '20.x', '22.x', '24.x' ]
+        include:
+          # A darwin leg is what covers the iOS-specific suites - they are gated
+          # on the platform and never execute anywhere else. One version is
+          # enough for that; 24 is the active LTS.
+          - os: macos-latest
+            node-version: '24.x'
 
     steps:
 
       - name: Harden the runner (Audit all outbound calls)
+        # only supported on the Ubuntu runners
+        if: runner.os == 'Linux'
         uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
         with:
           egress-policy: audit