package-lock is missing esbuild 0.21.5 platform optionals; npm 11 `npm ci` fails on linux

[timkindberg]

npm ci fails on Linux under npm 11:

npm error `npm ci` can only install packages when your package.json and package-lock.json … are in sync.
npm error Missing: @esbuild/aix-ppc64@0.21.5 from lock file
npm error Missing: @esbuild/linux-x64@0.21.5 from lock file
… (the whole platform matrix)

package-lock.json records the full @rollup/rollup-* platform matrix but no @esbuild/* entry for esbuild@0.21.5 (a transitive dep, likely via tsup). The three @esbuild/* entries it does have belong to a newer esbuild in the tree. npm 10 tolerated the gap; npm 11 rejects it.

It passes on macOS/arm64 with npm 11 (npm ci --dry-run is green), so it only bites on another platform — which is why CI never caught it.

Found while fixing #172's red build-and-smoke: that job wants npm 11 to dodge an unrelated arborist crash, and moving it to node 24 traded one red for another. The workaround there is npm i -g npm@11 after npm ci, so the repo install stays on the only npm the lockfile satisfies. That's a splint, not a fix.

Fix

Regenerate the lockfile so the optional platform set is complete — npm install --package-lock-only with the --os / --cpu overrides, or a full regeneration if that doesn't do it. Wants its own PR: verify the diff is additive (no version drift) and that npm ci is green on both npm 10 and 11.

Then drop the npm i -g npm@11 step and move the workflow to node 24 to match local dev.