ci: harden npm dependency checks

[TheRealAgentK]

Summary

• install dependencies with lifecycle scripts disabled, then explicitly run the SDK build
• add a read-only workflow permission baseline
• reject the known malicious keyv@6.0.0, flat-cache@6.1.24, and file-entry-cache@11.1.6 releases from every committed lockfile before installation
• audit runtime dependencies and verify npm registry signatures in CI
• install, audit, and smoke-test both example applications
• remove temporary dependency overrides now that ESLint's declared ranges naturally resolve to the same clean chain (file-entry-cache@8.0.0 → flat-cache@4.0.1 → keyv@4.5.4)

The exact-version denial is intentional even alongside signature verification: the malicious releases had valid npm OIDC provenance, so provenance alone would not have blocked this incident.

Verification

• npm ci --ignore-scripts
• npm run prepare
• npm test
• npm run test:cjs
• npm run eslint
• npm run tseslint
• npm exec -- prettier --check "lib/*.ts" "test/*.js" "examples/**/*.js"
• npm audit --omit=dev
• npm audit signatures
• clean resolved dependency chain confirmed with npm ls keyv flat-cache file-entry-cache
• Express and domains example installs, production audits, signature audits, and smoke checks
• workflow YAML syntax and git diff --check

[QuantumNightmare]

👍