#6 ci: pin the validator CLIs in a lockfile

Aikido flags this repo for a missing lockfile. CI was installing claude-code, codex, ajv and ajv-formats ad hoc, top level versions pinned but transitive deps floating and nothing for Aikido to scan.

Moves them into scripts/package.json with a lockfile and every job does npm ci from that. It's in scripts/ rather than the root because Claude Code runs npm install on a plugin's root package.json when you install it, tried it and every user would have pulled ~560MB of CI tooling! The claude and codex jobs install into $RUNNER_TEMP too since plugin marketplace add "$PWD" copies the whole dir, node_modules included.

Ran every job locally against this branch, all pass and the plugin cache after install is back to 148K.