fix(ci): honor the base lockfile when installing the head's exact release

[BenSheridanEdwards]

Why does this feature exist?

Cold npm base captures installed the head's exact StyleProof release inside the adopter checkout with lockfile resolution disabled. That second install could re-resolve unrelated ranged application dependencies on the base side only, producing real rendered differences that the pull request did not cause. The fix must preserve the dependency tree created by the base commit's frozen install.

What changed?

• Install the exact npm StyleProof runtime under the ephemeral CI session directory, then link only that package into the cold base worktree.
• Keep the adopter's application dependencies exactly as produced by npm ci; other package-manager paths remain unchanged.
• Add a CLI-level regression that simulates a ranged rendering dependency and requires base and head captures to observe the same locked version.
• Update the README and changelog for the corrected cold-capture contract.
• Refresh brace-expansion to the non-vulnerable lockfile release required by the Node 22 audit gate.
• Bound the deterministic demo's font wait externally so Chromium cannot deadlock the map-store dogfood capture.
• Prepare patch release 4.7.1; the merge-to-main release workflow will publish and tag it.

Behavioural Proof (with video and screenshots)

• Video: Not applicable — this changes CLI dependency isolation and CI capture reliability, not a rendered product interface.
• Screenshots: Not applicable — generated or self-attested images would not prove package-resolution behaviour.
• Behaviour tests:

Before: base rendering dependency = range-resolved; head = locked
After:  base rendering dependency = locked;         head = locked

styleproof-ci tests: 27 passed, 0 failed
repository tests:    631 passed, 0 failed
map-store demo:      5 passed, 0 failed
browser E2E:         116 passed, 0 failed
dependency audit:    0 vulnerabilities

Verification Summary

• Definition of Done: followed .agents/project/DEFINITION_OF_DONE.md.
• Commands run:
  • npm run build && npm run typecheck && npm run lint && npm run format:check
  • npm run privacy:check
  • npm test
  • npm run test:e2e
  • STYLEMAP_DIR=<temporary-directory> npx playwright test --config example/store-dogfood.playwright.config.ts --workers=2
  • npm audit --audit-level=high
  • npm pack --dry-run --json
• Results: all commands above pass; package contains the expected build output.
• Known risks or skipped checks: none. Hosted exact-head checks remain the merge gate.

Checklist

• Proof above — pasted the command/test output that demonstrates the change
• Capture/diff/report rendering is unchanged; demo report regeneration is not applicable
• npm run build && npm run typecheck && npm run lint && npm run format:check pass
• npm test and all 116 browser E2E tests pass
• Added/updated tests for the change
• Updated the README / CHANGELOG for changed behaviour
• Captured output format is unchanged; adopters do not need to regenerate baselines
• Followed .agents/project/DEFINITION_OF_DONE.md and .agents/skills/pr-inline-screenshot-proof/SKILL.md
• Screenshots are not applicable for a package-resolution and CLI orchestration change
• The PR body has no bare screenshot links, local paths, relative paths, or proof placeholders

[github-actions]

🗺️ StyleProof report

📊 View the side-by-side visual report →

---

Coverage, determinism, or report/diff consistency evidence is incomplete — repair the capture or reflow source; visual approval cannot clear this failure.