build(automation): bind commercial writer to exact reviewed Node/npm toolchain

[seonghobae]

Problem

The protected write-capable hourly commercial-readiness workflow previously ran under broader Node/npm/install semantics than reviewed CI and could complete its no-open-PR buyer-evidence path without retaining the expected artifact bundle.

RCA / selected remedy

First failing boundary: trusted default-branch commercial writer -> dependency installation / privileged automation -> retained commercial-readiness evidence.

The bounded root-cause remedy was to reuse the immutable reviewed setup-node revision and exact Node/npm identities, use frozen install flags, complete dependency installation before minting the Maintainer App token, and fail closed when the no-PR buyer-evidence bundle is absent. A bespoke writer container was materially larger and unnecessary.

Test-first protected integration

Fresh protected-main successor PR #216 completed this work.

• exact test-only RED: dd5885d8273dbf8156f031365b0c01e81a5e3b07;
• exact GREEN: 44a92501fb95e1d04336b494883ddd41a1e99736;
• application ci 31581061306: terminal success on the unchanged GREEN head;
• reviewer-ci 31581061347: terminal success;
• protected-base eligible central Security Scan 31581061369: terminal success;
• formal reviews: 0 and inline review threads: 0 at the final exact-head read;
• live ruleset 18794436 required the central Security Scan workflow and contained no current pull-request approval rule, so no synthetic approval requirement was invented;
• PR fix(automation): restack commercial writer exact toolchain on current main #216 merged without waiver as protected-main commit 2b3eee922efaa7ae2f11040b1a82a2ce305b75c6 and remains contained in current protected main.

Current protected source preserves checkout credential isolation, exact Maintainer App permissions, Node 24.19.0, npm 11.17.0, frozen npm ci --legacy-peer-deps=false --install-links=false, install-before-token-mint ordering, and if-no-files-found: error for the no-PR evidence bundle.

Acceptance

• Test-first contract preceded implementation.
• Workflow uses the reviewed setup-node revision and Node 24.19.0.
• Node v24.19.0 / npm 11.17.0 are explicitly verified before install.
• Install uses npm ci --legacy-peer-deps=false --install-links=false.
• Dependency installation completes before Maintainer App token mint.
• Existing checkout credential isolation, Maintainer App permission contract, governance loop and evidence paths remain bounded.
• Missing no-PR commercial-readiness evidence fails closed.
• Exact-head application CI, reviewer-ci, eligible central Security Scan, reviews and threads were revalidated before protected merge.
• No approval, merge authority, release/deployment, production KPI, revenue/customer, legal/IP-transfer, or acquisition-readiness claim is inferred from toolchain consistency.

This repository-owned toolchain hardening item is complete. External App provisioning/governance and real production/acquisition evidence remain separate under #29/#3/#5 and related lanes.

Related: #27, #29, #96, #150, #216