fix(ci): drop macos-13 (unsupported), fix audit test on CI runners

- Replace macos-13 with macos-15 in CI matrix (macos-13 no longer available)
- Set FORCE_JAVASCRIPT_ACTIONS_TO_NODE24 to silence Node.js 20 deprecation
- Fix test_cli_audit: accept exit code 1 when audit finds real failures
  (CI runners have firewall disabled, triggering severity "fail")

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: jgamblin

.github/workflows/ci.yml

@@ -6,12 +6,15 @@ on:
   pull_request:
     branches: [main]
 
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+
 jobs:
   test:
     runs-on: ${{ matrix.os }}
     strategy:
       matrix:
-        os: [macos-13, macos-14]
+        os: [macos-14, macos-15]
         python-version: ["3.10", "3.11", "3.12"]
     steps:
       - uses: actions/checkout@v4

tests/test_cli.py

@@ -38,9 +38,14 @@ def test_cli_clean_dry_run_default():
 
 
 def test_cli_audit():
+    """Test audit command runs without crashing.
+
+    Exit code may be 1 if audit finds real failures (e.g. firewall disabled
+    on CI runners), so we just check it doesn't crash (exit code 0 or 1).
+    """
     runner = CliRunner()
     result = runner.invoke(main, ["audit"])
-    assert result.exit_code == 0
+    assert result.exit_code in (0, 1)
 
 
 def test_cli_log_no_previous_run():