ci: use npm ci for reproducible workflow installs

[rogerchappel]

Summary

• Add the missing npm lockfile and use npm ci in CI for deterministic installs.

Verification

• npm ci (Node 24)
• npm run check
• npm test (17 passing)
• npm run build
• bash scripts/validate.sh
• git diff --check
• Manual review of CI workflow triggers: push and pull_request validation only; no release, deployment, or package publishing.

Risk Level

• Low

Notes: Adds a lockfile for the existing workspace dependencies and makes CI enforce it.

Rollback Plan

• Revert this PR's commit to restore the previous install command and remove the lockfile.

Human Decision Needed

• Maintainer review