Use `npm ci` instead of `npm install` in CI and deploy workflows

[thehabes]

Summary

Every workflow that installs dependencies runs npm install. It should run npm ci, so that CI and the deploy servers install exactly the tree recorded in package-lock.json.

Why this matters

npm install is allowed to resolve newer versions inside the declared semver ranges and to rewrite package-lock.json in place. Two consequences:

• The CI test job can pass against a dependency tree that is not the one reviewed and approved in the PR.
• The deploy servers can install a tree that was never tested anywhere.

npm ci installs the lockfile exactly, never writes to it, and fails loudly if package.json and package-lock.json have drifted apart.

This surfaced while reviewing #293, which curates the dependency set so that npm-check and npm audit are both clean. That work only holds if the lockfile is what actually gets installed.

Affected lines

File	Line	Current
.github/workflows/cd_dev.yaml	29	run: npm install (test job)
.github/workflows/cd_dev.yaml	59	npm install (deploy step)
.github/workflows/cd_prod.yaml	31	run: npm install (test job)
.github/workflows/cd_prod.yaml	58	npm install (deploy step)

Proposed change

Test jobs:

      - name: Install dependencies
        run: npm ci
      - name: Generate coverage report
        run: npm run coverage:ci

Deploy steps: npm ci. Worth considering npm ci --omit=dev on the deploy steps as well, since a bare install currently puts c8, supertest, yargs, glob, and the rest of the test tooling into production node_modules. That is a related but separable concern — happy to split it into its own issue if preferred.

Notes

• The lockfile is already ci-ready. Verified on the 8-24-26-packages branch: npm ci in a clean directory installs 169 packages and reports 0 vulnerabilities.
• npm ci requires package-lock.json to exist and to agree with package.json. Both hold today.
• npm ci deletes node_modules before installing. On the self-hosted deploy runners (vlcdhp02, vlcdhprdp02) this makes installs slower but reproducible. The actions/cache@v4 step already in both workflows should absorb most of that cost on the GitHub-hosted test jobs.

Acceptance criteria

• cd_dev.yaml and cd_prod.yaml use npm ci in the test jobs
• cd_dev.yaml and cd_prod.yaml use npm ci in the deploy steps
• A CI run completes with package-lock.json unmodified afterward
• Dev deploy verified healthy before the same change reaches prod