fix(ci): replace npm install with npm ci in all workflows

[MattDevy]

Summary

• Replaces all bare npm install calls in CI/release workflows with npm ci
• Covers 4 occurrences: test-node, license-header, notice-file (ci.yml), and the release publish step (release.yml)
• npm ci enforces exact lockfile resolution and fails on drift; npm install can silently rewrite package-lock.json and pick up drifted transitive deps

Fixes #238 (ECLI-001 from Infosec review)

Test plan

• Verify CI passes on this PR (the npm ci calls succeed with the existing lockfile)
• Confirm no remaining npm install in .github/workflows/

[github-actions]

✅MegaLinter analysis: Success

Descriptor	Linter	Files	Fixed	Errors	Warnings	Elapsed time
✅ ACTION	actionlint	2		0	0	0.09s
✅ COPYPASTE	jscpd	yes		no	no	8.16s
✅ REPOSITORY	gitleaks	yes		no	no	78.0s
✅ REPOSITORY	git_diff	yes		no	no	0.46s
✅ REPOSITORY	secretlint	yes		no	no	12.0s
✅ REPOSITORY	trivy	yes		no	no	19.52s
✅ YAML	yamllint	2		0	0	0.74s

See detailed reports in MegaLinter artifacts
Set VALIDATE_ALL_CODEBASE: true in mega-linter.yml to validate all sources, not only the diff

MegaLinter is graciously provided by OX Security
Show us your support by starring ⭐ the repository