CI: pin wrangler/tsx versions in deploy scripts (unpinned global installs run with deploy credentials)

## Summary

CI deploy scripts install unpinned npm packages globally in workflows that carry GitHub and Cloudflare credentials:

- `scripts/cicd/pr-playwright-deploy-and-comment.sh:57` — `npm install -g wrangler@^4.0.0`
- `scripts/cicd/pr-playwright-deploy-and-comment.sh:67` — `npm install -g tsx`
- `scripts/cicd/pr-storybook-deploy-and-comment.sh:56` — `npm install -g wrangler@^4.0.0`

Verified at `origin/main` @ `28bd73af290b`.

## Why it matters

`tsx` resolves to whatever the latest release is at run time; `wrangler@^4.0.0` accepts any future 4.x. A compromised or breaking publish executes install hooks inside CI with `GITHUB_TOKEN` + Cloudflare secrets in the environment — no repo change required, and the blast is invisible in the diff history.

## Suggested fix

Pin exact versions (`wrangler@4.x.y`, `tsx@x.y.z`) and update via Renovate/Dependabot like other dependencies, or run them via `npx --yes package@exact`. Optionally add `--ignore-scripts` where the tool works without install hooks.

## Provenance

Found in a cross-repo CI hardening audit (bash-defensive-patterns lens), 2026-08-21. No existing issue found for this.

Start with the three commands in scripts/cicd/pr-playwright-deploy-and-comment.sh at lines 57 and 67 and scripts/cicd/pr-storybook-deploy-and-comment.sh at line 56. Check how other dependencies are updated by Renovate or Dependabot, then pin the wrangler and tsx installs to exact versions. Done means all listed global installs are exact-versioned and the affected deploy workflows still complete successfully.

Written by the indexing model from the issue text.