chore: harden npm installs

[linuz90]

This keeps the open-source skills repo on npm while adding the npm 11 safeguards we wanted.

Summary

• npm baseline: pins packageManager: npm@11.13.0, adds Node/npm engines, and commits a deterministic package-lock.json.
• Install hardening: adds .npmrc with min-release-age=7, allow-git=none, and engine-strict=true.
• CI hardening: drops Node 18 from the matrix, installs pinned npm 11, and switches dependency install from npm install to npm ci.

Validation

• npx -y npm@11.13.0 ci
• npx -y npm@11.13.0 test

After Merge

No action required