ci: pin npm to exact version 12.0.2

[achoimet]

SonarCloud's GitHub Actions dependency-hardening rules flag npm install -g npm@12 as an unpinned dependency installation (floating range = supply-chain risk); the same finding just failed the platform nightly quality gate. This pins the npm upgrade to the exact version 12.0.2. Future npm 12.x patches now need an explicit bump.

[claude]

Claude finished @achoimet's task in 30s —— View job

---

Claude finished reviewing this PR

• Check previously unresolved review threads for fixes (none found)
• Gather context (diff, CLAUDE.md)
• Review new changes
• Post final summary

Review

This is a minimal, low-risk change: it pins npm install -g npm@12 to an exact version npm install -g npm@12.0.2 in two places in .github/workflows/reusable-extension-ci.yml (lines 150 and 446), addressing SonarCloud's dependency-hardening/unpinned-version finding.

• Both occurrences of the unpinned npm@12 install were updated consistently — no stragglers left in the workflow.
• No other unpinned npm install -g calls remain in .github/workflows/.
• No functional, security, or performance concerns — this only tightens a version constraint that was already effectively resolving to a specific version at install time.
• Trade-off (noted in the PR description, not a defect): future npm 12.x patch releases will require an explicit version bump in this file going forward.

No issues found.