[Fix] App image builds fail during npm publication races

[roomote-roomote]

Created by Roomote. Follow up by mentioning @roomote, in the web UI, or in Slack.

What changed

• Added a dedicated, exact Snowflake runtime dependency manifest and committed npm lockfile for the app image.
• Replaced the image's fresh npm install resolution with npm ci.
• Added a build-time guard that rejects drift between the API workspace's resolved Snowflake SDK and the runtime manifest.

Why this change was made

The app image previously resolved Snowflake's full transitive dependency tree from npm during every build. An upstream package publication race could therefore break otherwise unrelated image builds.

Impact

App image builds now use one reviewable, integrity-checked dependency tree and only change it when the committed lockfile changes. The locked install and repository checks pass locally; an end-to-end image build was unavailable in this sandbox because it does not expose a Docker socket, so CI remains the final image-build verification.

[roomote-roomote]

No code issues found. See task

_{Reviewed 4267382}