fix: make repo.dependencies launch-gate check read-only

[Copilot]

The repo.dependencies launch-gate check was running npm install --package-lock-only --ignore-scripts, which mutates package-lock.json. A launch gate must be read-only.

• Replaced with npm ci --dry-run, which validates package-lock.json/package.json consistency without writing any files
• Still returns non-zero on drift, preserving the hard-gate semantics

-    ['install', '--package-lock-only', '--ignore-scripts'],
+    ['ci', '--dry-run'],

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 95e879ff21

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Add --ignore-scripts to keep launch gate read-only

Switching repo.dependencies to npm ci --dry-run removed the previous --ignore-scripts guard, so lifecycle scripts can run during the launch gate. npm ci --help shows --ignore-scripts as an opt-in flag, and in practice npm ci --dry-run still executes preinstall scripts; that means repositories with install hooks can mutate files or trigger external side effects even in strict mode, which breaks the intended read-only/safe gate behavior.

Useful? React with 👍 / 👎.