ci: harden npm dependency checks

[TheRealAgentK]

Summary

• install dependencies with lifecycle scripts disabled, then explicitly run the package build
• add a read-only workflow permission baseline
• reject the known malicious keyv@6.0.0, flat-cache@6.1.24, and file-entry-cache@11.1.6 releases from every committed lockfile before installation
• audit runtime dependencies and verify npm registry signatures in CI
• install, audit, and invoke the example Lambda handler's successful path
• remove temporary dependency overrides now that ESLint's declared ranges naturally resolve to the same clean chain (file-entry-cache@8.0.0 → flat-cache@4.0.1 → keyv@4.5.4)

The exact-version denial is intentional even alongside signature verification: the malicious releases had valid npm OIDC provenance, so provenance alone would not have blocked this incident.

Verification

• npm ci --ignore-scripts
• npm run prepare
• npm test
• npm run eslint
• npm run tseslint
• npm run prettier:check
• npm audit --omit=dev
• npm audit signatures
• clean resolved dependency chain confirmed with npm ls keyv flat-cache file-entry-cache
• example install, production audit, signature audit, and handler smoke test
• workflow YAML syntax and git diff --check

[QuantumNightmare]

👍