Release installs stay portable everywhere

A lockfile generated by a newer local npm could omit optional image-processing dependencies that the Linux runner still needed. The repository now pins the package-manager version that owns this release contract.

• npm 10.9.8 is the canonical installer for Miracle.
• One reviewed lockfile command regenerates dependency metadata without running package scripts.
• Sharp’s portable WebAssembly support remains present across operating systems.
• A permanent test blocks a locally valid lockfile from stranding hosted installation before release checks begin.