ci: make TypeScript checks reproducible

[rogerchappel]

Summary

• declare and lock the TypeScript CLI used by the repository typecheck
• make CI install the locked dependency graph with npm ci
• document npm and the clean contributor setup command

Verification

• Tests or checks run:
  • npm ci
  • env PATH="/private/tmp/oss-worker-bargekit-1401-7FPNuT/tool-bin:/bin:/usr/bin" npm run typecheck
  • env PATH="/private/tmp/oss-worker-bargekit-1401-7FPNuT/tool-bin:/bin:/usr/bin" npm run release:check (35 tests passed; build, smoke, and package smoke passed)
  • bash scripts/validate.sh
  • actionlint .github/workflows/ci.yml
  • git diff --check origin/main..HEAD
• Manual review completed:
  • confirmed open PRs ci: bump actions/checkout from 4 to 7 #9 and ci: bump actions/setup-node from 4 to 7 #15 only update GitHub Actions versions and do not overlap the package toolchain or install command
  • confirmed all three commits use Roger Chappel <miscanalysis@gmail.com> as author and committer

Commit-by-commit changes

• be38e91 chore: declare TypeScript toolchain — add exact TypeScript dev dependency and npm lockfile
• 99401fe ci: use clean npm installs — replace mutable npm install with npm ci
• 530d358 docs: document reproducible contributor setup — name npm and document clean install/release verification

Risk Level

• Low
• Medium
• High

Notes: This changes development and CI dependency installation only; published package runtime behavior is unchanged.

Rollback Plan

• Revert the three commits to restore the prior globally supplied TypeScript toolchain and mutable CI install.

Human Decision Needed

• None
• Maintainer review
• Product/design decision
• Security/privacy review
• Other: