Enforce npm >=12.0.2 (blocked by two peer dependency conflicts)

Every other npm-based repository in the `bifravst`, `hello-nrfcloud`, `memfault`
and `nRFCloud` orgs has been moved to npm `>=12.0.2 <13`, enforced via
[`check-node-version`](https://www.npmjs.com/package/check-node-version) on
`npm install` and `npm ci`. This repository is the one that could not be done,
because it is blocked by two pre-existing peer dependency conflicts.

## Why npm v12

npm v12 turns three code-execution paths off by default — most notably the
unauthorized execution of install scripts, the primary vector for supply-chain
attacks via compromised dependencies
([GitHub changelog](https://github.blog/changelog/2026-06-09-upcoming-breaking-changes-for-npm-v12/)):

- **`allowScripts` defaults to off**, so `npm install` no longer executes
`preinstall`, `install` or `postinstall` scripts from dependencies unless they
are explicitly allowed in `package.json`. This also covers `prepare` scripts
from `git`, `file` and `link` dependencies.
- **`--allow-git` defaults to `none`**, closing a code-execution path where a git
dependency's `.npmrc` could override the git executable, even with
`--ignore-scripts`.
- **`--allow-remote` defaults to `none`**, blocking dependencies from remote URLs
such as HTTPS tarballs.

## Why this repository is blocked

The change requires adding `check-node-version` as a devDependency, which means
npm has to re-resolve the dependency tree. That re-resolution fails on two stale
pins:

```
npm error ERESOLVE unable to resolve dependency tree
npm error Found: constructs@10.4.4
npm error Could not resolve dependency:
npm error peer constructs@"^10.5.0" from aws-cdk-lib@2.260.0
```

and, once that one is worked around, a second, independent one:

```
npm error Found: @aws-lambda-powertools/metrics@2.30.0
npm error Could not resolve dependency:
npm error peer @aws-lambda-powertools/metrics@"^2.33.1" from @hello.nrfcloud.com/lambda-helpers@5.0.51
```

**CI is not affected today**, because the workflows run `npm ci`, which installs
from the committed `package-lock.json` without re-resolving. The conflicts are
latent and only surface on `npm install`.

Working around them with `--legacy-peer-deps` was tried and rejected: it forces a
full re-resolution and produced **130 changed dependency versions and 97
removals** (the whole `@aws-sdk/*` set jumping from `3.948.0` to `3.1097.0`).
That is a dependency upgrade, not an npm version bump, and does not belong in
this change.

## What needs to happen

1. Bump `constructs` to satisfy `aws-cdk-lib@2.260.0`'s `^10.5.0` peer range.
2. Bump `@aws-lambda-powertools/metrics` to satisfy
`@hello.nrfcloud.com/lambda-helpers@5.0.51`'s `^2.33.1` peer range.
3. Re-check for any further conflicts, then apply the npm v12 change:
- `engines.npm` → `>=12.0.2 <13` (leaving `engines.node` untouched)
- add `check-node-version` as a devDependency
- `prepare` → `husky && case "$npm_command" in install|ci) check-node-version --package ;; esac`
(the guard skips the check during `npm publish`/`npm pack`, because
`semantic-release` bundles its own npm — `@semantic-release/npm` depends on
`npm@^11.6.2`)
- add a `.github/actions/install-npm` composite action that installs the
version from `engines.npm`, and reference it after each
`actions/setup-node` step in the workflows that run `npm ci`

Steps 1 and 2 are a routine dependency update and are best done on their own.

Start with package.json and package-lock.json, then inspect the workflow files that run npm ci and the existing repository action layout. Resolve the two peer dependency pins, apply the engines, devDependency, and prepare changes, and add the install-npm composite action. Done means npm install and npm ci succeed without unintended dependency churn and all relevant workflows use the action.

Written by the indexing model from the issue text.