fix(supply-chain): pin the npm lockfile generator and prove reproduction

[seonghobae]

Problem

BandScope's protected lockfile is consumed by CI with npm 10.9.8, but the source tree does not declare or enforce that generator. Dependency pull requests therefore include inconsistent metadata churn—most visibly repeated removal of peer: true from unrelated @esbuild/* location records—without proving whether the churn is canonical for the repository's supported npm version.

A lockfile is reproducible only when its package manifest, install flags, and generator version are one reviewed contract. Separate dependency PRs must not silently choose a different npm algorithm.

Test-first state

Exact RED head: 4294ddc6c549ba805032e6d828ffbb2ddb9b43a2.

The first commit adds only services/analysis-engine/tests/test_npm_toolchain_contract.py. It requires:

• packageManager: npm@10.9.8;
• exact npm enforcement through engines.npm and devEngines.packageManager;
• the existing CI Node 22.22.3 toolchain to assert npm 10.9.8 before installation;
• an exact package-lock-only regeneration followed by a clean git diff; and
• npm lockfile version 3.

Protected develop lacks the first four contracts, so the new test must fail before implementation.

Intended GREEN implementation

• Add the exact npm generator metadata without changing the existing Node runtime support decision.
• Make primary CI verify npm --version, perform the normal clean install, regenerate only the lockfile with scripts/audit/funding disabled, and reject any diff.
• If npm 10.9.8 changes the protected lock, accept only the exact reproducible output produced by that toolchain and document the metadata effect; do not hand-edit lock records.
• Add an operator/doctoring record with APA 7 references to official npm package, devEngines, npm ci, and package-lock documentation.
• Update CHANGELOG.md under Unreleased.

Merge gate

Keep Draft until RED evidence is observed, the exact generator produces a stable lock twice, all repository quality/security/supply-chain checks succeed on the final exact head, CodeRabbit/OpenCode/Noema and a qualifying independent non-author approval are current, actionable threads are zero, and branch protection permits merge without bypass.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 8f0ba875-edc6-4307-b38d-06449e2d53b1

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}