feat: ESM-only release for CodeceptJS 4.x

* Drop the createRequire/require('codeceptjs') bridge in favour of a
  native ESM `import { output } from 'codeceptjs'`. End users on
  CodeceptJS 4.x share the host's module graph; no more dual-singleton
  hazard or stale nested codeceptjs leaking in.
* Same treatment for chai-match-pattern and chai-json-schema-ajv —
  default-imported once, no in-method `require`s.
* Drop CJS export entry and the `index.cjs` shim. CodeceptJS 4.x is
  ESM-only; matching here.
* `peerDependencies.codeceptjs` is now `>=4.0.0-rc.1`, marked optional
  so npm doesn't pull a stale 3.x copy alongside a 4.x host.
* Bump version label to 4.0.0-beta.1.
* Replace semantic-release / NPM_TOKEN workflow with an OIDC trusted-
  publisher workflow (Node 24, latest npm, gated on `npm test`,
  publishes with `--provenance --access public`; derives dist-tag from
  prerelease label).
* Test workflow: trigger on 4.x + main + PRs; Node 20/22/24 matrix.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: DavertMik

.github/workflows/node.yml

@@ -2,27 +2,28 @@ name: NodeJS Tests
 
 on:
   push:
-    branches: [ "main" ]
+    branches:
+      - 4.x
+      - main
   pull_request:
-    branches: [ "main" ]
+    branches:
+      - '**'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
 
 jobs:
   build:
     runs-on: ubuntu-latest
-
     strategy:
       matrix:
-        node-version: [20.x, 22.x]
-
+        node-version: [20.x, 22.x, 24.x]
     steps:
-    - uses: actions/checkout@v4
-
-    - name: Use Node.js ${{ matrix.node-version }}
-      uses: actions/setup-node@v4
-      with:
-        node-version: ${{ matrix.node-version }}
-
-    - name: Test
-      run: |
-        npm install
-        npm test
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: ${{ matrix.node-version }}
+      - run: npm install -g npm@latest
+      - run: npm install
+      - run: npm test

.github/workflows/npm-publish.yml

@@ -0,0 +1,54 @@
+name: Publish to npm
+
+on:
+  release:
+    types: [published]
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.release.target_commitish }}
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 24
+
+      - run: npm install -g npm@latest
+      - run: npm install
+      - run: npm test
+
+  publish:
+    needs: test
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.release.target_commitish }}
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 24
+          registry-url: 'https://registry.npmjs.org'
+
+      - run: npm install -g npm@latest
+      - run: npm install
+
+      - name: Set package version from release tag
+        run: npm version "${{ github.event.release.tag_name }}" --no-git-tag-version
+
+      - name: Publish to npm
+        run: |
+          VERSION="${{ github.event.release.tag_name }}"
+          if [[ "$VERSION" == *-* ]]; then
+            TAG=$(echo "$VERSION" | sed -E 's/^[^-]+-([a-zA-Z]+).*/\1/')
+            npm publish --provenance --access public --tag "$TAG"
+          else
+            npm publish --provenance --access public
+          fi

.github/workflows/publish.yml

@@ -1,12 +1,11 @@
 import { use, expect, assert } from 'chai';
 import chaiExclude from 'chai-exclude';
-import { createRequire } from 'module';
-
-const require = createRequire(import.meta.url);
-const { output } = require('codeceptjs');
+import chaiMatchPattern from 'chai-match-pattern';
+import chaiJsonSchemaAjv from 'chai-json-schema-ajv';
+import { output } from 'codeceptjs';
 
 use(chaiExclude);
-use(require('chai-match-pattern'));
+use(chaiMatchPattern);
 
 /**
  * This helper allows performing assertions based on Chai.
@@ -173,7 +172,7 @@ class ExpectHelper {
     output.step(
       `I expect "${JSON.stringify(targetData)}" to match this JSON schema using AJV "${JSON.stringify(jsonSchema)}"`,
     )
-    use(require('chai-json-schema-ajv').create(ajvOptions))
+    use(chaiJsonSchemaAjv.create(ajvOptions))
     return expect(targetData, customErrorMsg).to.be.jsonSchema(jsonSchema)
   }