ci: harden workflow install boundaries

- run non-test workflow installs with npm ci --ignore-scripts where lifecycle scripts are not needed\n- reject plain npm ci in workflows with write permissions\n- reject actions/cache in id-token: write workflows to reduce OIDC publish cache-poisoning risk

.github/workflows/ci.yml

@@ -261,7 +261,7 @@ jobs:
           node-version: '20.x'
 
       - name: Install dependencies
-        run: npm ci
+        run: npm ci --ignore-scripts
 
       - name: Run ESLint
         run: npx eslint scripts/**/*.js tests/**/*.js

.github/workflows/maintenance.yml

@@ -33,7 +33,7 @@ jobs:
       - name: Run security audit
         run: |
           if [ -f package-lock.json ]; then
-            npm ci
+            npm ci --ignore-scripts
             npm audit --audit-level=high
           else
             echo "No package-lock.json found; skipping npm audit"