v3/@claude-flow/browser standalone package-lock.json can't refresh from workspace:* via npm install

## Summary

`v3/@claude-flow/browser/package.json` is intended for standalone npm publish (per accepted-findings.json comment dated 2026-05-19) and ships its own `package-lock.json`. The package.json contains workspace:* protocol references that `npm install --package-lock-only` cannot resolve in isolation (`EUNSUPPORTEDPROTOCOL`), so the package-lock graph can drift behind the package.json spec.

Concrete symptom today: `vitest` was bumped `^4.0.16` → `^4.1.0` in package.json to clear GHSA-5xrq-8626-4rwp (CVSS 9.8), but the package-lock still resolves the older 4.0.16 transitive graph. `npm audit` in the standalone dir still flags critical-severity vitest until the lock is regenerated through the workspace.

## Workaround in place

A time-boxed accepted-findings entry (expires 2026-09-02) suppresses the audit failure with the rationale: devDependency-only + UI-server-only attack vector + zero production exposure (`--omit=dev`).

## What to do here

One of:
1. Add a npm-postinstall step (or scripts/sync-browser-lockfile.mjs) that rewrites workspace:* to file: refs before `npm install --package-lock-only`, then restores.
2. Switch the browser package to publish without a standalone package-lock and document install-from-tarball semantics.
3. Move the standalone bundling into a CI release step that runs from a temp dir with the workspace deps already packed.

Once any of those land, the accepted-findings entry for vitest can be deleted and the next `npm audit` will validate the fix.

## Related

- accepted-findings.json entry: `v3/@claude-flow/browser :: vitest`, expires 2026-09-02
- The lockfile refresh that didn't propagate: `v3/pnpm-lock.yaml` correctly carries vitest 4.1.x; only the standalone npm lock didn't update.

Start with v3/@claude-flow/browser/package.json and its standalone package-lock.json, then run npm install --package-lock-only from the browser directory to reproduce the workspace:* failure. Compare the standalone lock with v3/pnpm-lock.yaml and inspect accepted-findings.json. Done means one documented or automated refresh path works and npm audit no longer reports the stale vitest graph.

Written by the indexing model from the issue text.