core: evaluate node semver ranges instead of guessing the leading major

resolve_node_bin() could not parse a range, so it fell back to "pin by the
first number in the string" and took the newest installed version of that
major. For openclaw's engines pin `>=22.19.0 <23 || >=23.11.0` that picked
v22.17.0 — below the range's own floor — and baked it into the service's
unit PATH. The daemon refused to start on it and crash-looped 260k+ times
(~7.4s CPU per attempt, every ~5.5s, since before the journal's retention
window). StartLimitBurst never tripped because five attempts span ~27s,
outside the 10s StartLimitIntervalUSec.

Parse the pin properly: split on `||`, expand each comparator (>=, >, <=,
<, =, ^, ~, hyphen ranges, x/* wildcards, partial versions) into bounds
with node-semver's partial semantics, and pick the newest installed version
satisfying any alternative. openclaw now resolves to v24.18.0 via its
second alternative. A pin this parser cannot read at all still falls back
to newest-installed rather than guessing a version.

When nothing satisfies the pin it now fails with the installed versions
listed, so the next occurrence is diagnosable at apply time rather than
six days later in a restart loop.

core/tests/test_toolchains.py

@@ -118,4 +118,84 @@ class TestResolveNodeBin:
 
     def test_default_dir_is_nvm(self, monkeypatch: pytest.MonkeyPatch) -> None:
         monkeypatch.delenv("WILDPC_NODE_VERSIONS_DIR", raising=False)
-        assert toolchains.node_versions_dir() == Path.home() / ".nvm" / "versions" / "node"
+        assert (
+            toolchains.node_versions_dir() == Path.home() / ".nvm" / "versions" / "node"
+        )
+
+
+class TestSemverRanges:
+    """Range pins are evaluated, not reduced to their leading major.
+
+    The regression these guard: openclaw pins `>=22.19.0 <23 || >=23.11.0`, and a
+    leading-major heuristic picked the newest installed 22.x — v22.17.0, *below*
+    the range's own floor — baking a node into the systemd unit that the program
+    refuses to run on."""
+
+    def test_compound_range_uses_later_alternative(
+        self, tmp_path: Path, nvm: Path
+    ) -> None:
+        _install(nvm, "v24.18.0", "v22.17.0", "v20.19.3")
+        (tmp_path / "package.json").write_text(
+            '{"engines": {"node": ">=22.19.0 <23 || >=23.11.0"}}'
+        )
+        assert resolve_node_bin(tmp_path) == nvm / "v24.18.0" / "bin"
+
+    def test_never_picks_below_lower_bound(self, tmp_path: Path, nvm: Path) -> None:
+        # Only a 22.x that fails the pin's own >=22.19.0 floor is installed.
+        _install(nvm, "v22.17.0", "v20.19.3")
+        (tmp_path / "package.json").write_text(
+            '{"engines": {"node": ">=22.19.0 <23 || >=23.11.0"}}'
+        )
+        with pytest.raises(ToolchainError, match="no installed version satisfies"):
+            resolve_node_bin(tmp_path)
+
+    def test_upper_bound_excludes_newer(self, tmp_path: Path, nvm: Path) -> None:
+        _install(nvm, "v24.18.0", "v22.19.1")
+        (tmp_path / "package.json").write_text('{"engines": {"node": ">=22.19.0 <23"}}')
+        assert resolve_node_bin(tmp_path) == nvm / "v22.19.1" / "bin"
+
+    def test_error_names_installed_versions(self, tmp_path: Path, nvm: Path) -> None:
+        _install(nvm, "v22.17.0")
+        (tmp_path / "package.json").write_text('{"engines": {"node": ">=24"}}')
+        with pytest.raises(ToolchainError, match=r"installed: 22\.17\.0"):
+            resolve_node_bin(tmp_path)
+
+    def test_tilde_pins_minor(self, tmp_path: Path, nvm: Path) -> None:
+        _install(nvm, "v24.15.0", "v24.14.9", "v24.14.1")
+        (tmp_path / ".nvmrc").write_text("~24.14.1")
+        assert resolve_node_bin(tmp_path) == nvm / "v24.14.9" / "bin"
+
+    def test_caret_excludes_next_major(self, tmp_path: Path, nvm: Path) -> None:
+        _install(nvm, "v25.0.0", "v24.14.1")
+        (tmp_path / "package.json").write_text('{"engines": {"node": "^24.1.0"}}')
+        assert resolve_node_bin(tmp_path) == nvm / "v24.14.1" / "bin"
+
+    def test_gt_partial_means_next_major(self, tmp_path: Path, nvm: Path) -> None:
+        # node-semver: ">22" is >=23.0.0, so an installed 22.19.0 does not match.
+        _install(nvm, "v23.1.0", "v22.19.0")
+        (tmp_path / "package.json").write_text('{"engines": {"node": ">22"}}')
+        assert resolve_node_bin(tmp_path) == nvm / "v23.1.0" / "bin"
+
+    def test_exact_pin_excludes_neighbours(self, tmp_path: Path, nvm: Path) -> None:
+        _install(nvm, "v24.14.9", "v24.14.1")
+        (tmp_path / ".node-version").write_text("=24.14.1")
+        assert resolve_node_bin(tmp_path) == nvm / "v24.14.1" / "bin"
+
+    def test_hyphen_range(self, tmp_path: Path, nvm: Path) -> None:
+        _install(nvm, "v24.0.0", "v23.5.0", "v22.1.0")
+        (tmp_path / "package.json").write_text(
+            '{"engines": {"node": "22.19.0 - 23.11.0"}}'
+        )
+        assert resolve_node_bin(tmp_path) == nvm / "v23.5.0" / "bin"
+
+    def test_x_wildcard_minor(self, tmp_path: Path, nvm: Path) -> None:
+        _install(nvm, "v25.0.0", "v24.14.1")
+        (tmp_path / ".node-version").write_text("24.x")
+        assert resolve_node_bin(tmp_path) == nvm / "v24.14.1" / "bin"
+
+    def test_unparseable_pin_falls_back_to_newest(
+        self, tmp_path: Path, nvm: Path
+    ) -> None:
+        _install(nvm, "v24.14.1", "v20.10.0")
+        (tmp_path / ".nvmrc").write_text("lts/hydrogen")
+        assert resolve_node_bin(tmp_path) == nvm / "v24.14.1" / "bin"