…ename flake

… npm 2/3 cannot stage eslint 10`@types/esrecurse`

node 7's bundled npm 4.2.0 can neither self-upgrade
(`Cannot read property 'path' of null`)
nor TLS-handshake with the current registry (EPROTO),
and node 5 segfaults in the `prepublish` lifecycle.
Since the deps are pure JS, install them with a modern node + npm
(skipping lifecycle scripts),
then switch to the target node only to run the tests.

The two finalizing reduces used `prev.concat(arg)` as the accumulator,
reallocating and copying the whole array each iteration,
so `parse()` ran in O(n²) in the token count
— a small (~128 KB) input could block the event loop for tens of seconds (CWE-407 DoS).
Push into the accumulator instead,
flattening one-level array entries with `forEach`
(not `.apply`, which can overflow the argument limit on large inputs)
Output is byte-identical;
`engines >= 0.4` is preserved (no `.flat()`).