ci: use npm ci for website checks

[FrankChen021]

What changed

Use npm ci instead of npm install when installing website dependencies in the web checks workflow.

Why

The repository commits website/package-lock.json, and Dependabot security updates can intentionally modify only that lockfile when updating a transitive dependency. npm install may reconcile or rewrite dependency resolution during CI, which means a passing build does not prove that the committed manifest and lockfile are consistent or that the exact locked dependency graph was tested.

npm ci fails when package.json and package-lock.json disagree, installs the exact committed dependency graph, and does not rewrite the lockfile. This makes website dependency checks reproducible while leaving the local development workflow unchanged; developers can continue to use npm install when adding or updating dependencies.

Validation

• bash -n .github/scripts/web-checks.sh
• cd website && npm ci
• npm run build
• npm run link-lint
• npm run spellcheck

[Copilot]

Pull request overview

This PR updates the website dependency installation step used by CI web checks to be reproducible and to validate that the committed package-lock.json matches package.json.

Changes:

• Switch website dependency installation from npm install to npm ci in the web checks script.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.