ci: use locked ESM smoke dependencies - #11128

Summary

Fixes CI runs

Linked issue

N/A

Changes

N/A

Checklist

• Tests added or updated (or N/A with reason)
• Docs/types updated if public API changed (index.d.ts and index.d.cts)
• No breaking changes (or called out explicitly above)

Summary by cubic

Lock ESM smoke test dependencies and switch CI to use npm ci for deterministic installs on npm 10, reducing flakiness in ESM smoke runs. Updates the tests/smoke/esm lockfile to pin versions and align with newer vite/rolldown.

Description

• Summary of changes

  • CI: replace npm install with npm ci --ignore-scripts for tests/smoke/esm.
  • Update tests/smoke/esm/package-lock.json to lock deps (e.g. vitest@4.1.9, vite@8.2.0, rolldown@1.2.2, lightningcss@1.33.0, postcss@8.5.25).
  • Pin @rolldown/* native bindings to 1.2.2; remove wasm/emnapi optional deps from the lockfile.

• Reasoning

  • npm ci enforces reproducible installs under npm 10 and prevents drift from upstream minor releases.
  • Newer vite/rolldown match current engines and stabilize the ESM smoke build.

• Additional context

  • Affects only CI and the tests/smoke/esm fixture; no runtime or public API changes.

Docs

• Suggest adding a short note in /docs/ (e.g., contributing/CI) that smoke test fixtures should be installed with npm ci --ignore-scripts and keep their lockfiles committed.

Testing

• No new tests. ESM smoke tests continue to run in CI with the locked dependencies. Additional tests are not needed for this CI-only change.

Semantic version impact

• None. CI/test-only changes with no impact on published packages.

^{Written for commit fd747ca. Summary will update on new commits.}