Replaces various uses of `npm install` with `npm ci --ignore-scripts`.
This should both be more hermetic (it'll always use the locked versions
rather than re-resolving) and will partially mitigate some build-time
code execution risk.
There should be no breakage risk, as the current dependency footprint is
small and shouldn't include anything that uses build scripts 🙂
Signed-off-by: William Woodruff <william@astral.sh>
