Build reproducibility verified

Using npm install in CI instead of npm ci means the lockfile is advisory rather than enforced — if package.json and the lockfile diverge (a common accident after a manual install), CI installs different versions than the lockfile specifies, silently breaking reproducibility. SLSA L2 and SSDF SP 800-218 PW.4.1 both require that the build process is deterministic and traceable. A non-reproducible build makes security audits meaningless: you cannot verify what code shipped without knowing exactly which dependency versions were installed.

Replace npm install with npm ci in all CI configuration. npm ci errors if the lockfile and package.json are out of sync, enforcing that the lockfile is the authoritative source.

# .github/workflows/ci.yml
- name: Install dependencies
  run: npm ci

For Docker builds, copy the lockfile before installing:

COPY package.json package-lock.json ./
RUN npm ci --only=production

For Yarn: yarn install --frozen-lockfile. For pnpm: pnpm install --frozen-lockfile.