package-lock is missing esbuild 0.21.5 platform optionals; npm 11 `npm ci` fails on linux

npm ci fails on Linux under npm 11:

npm error `npm ci` can only install packages when your package.json and package-lock.json … are in sync.
npm error Missing: @esbuild/aix-ppc64@0.21.5 from lock file
npm error Missing: @esbuild/linux-x64@0.21.5 from lock file
… (the whole platform matrix)

package-lock.json records the full @rollup/rollup-* platform matrix but no @esbuild/* entry for esbuild@0.21.5 (a transitive dep, likely via tsup). The three @esbuild/* entries it does have belong to a newer esbuild in the tree. npm 10 tolerated the gap; npm 11 rejects it.

It passes on macOS/arm64 with npm 11 (npm ci --dry-run is green), so it only bites on another platform — which is why CI never caught it.

Found while fixing #172's red build-and-smoke: that job wants npm 11 to dodge an unrelated arborist crash, and moving it to node 24 traded one red for another. The workaround there is npm i -g npm@11 after npm ci, so the repo install stays on the only npm the lockfile satisfies. That's a splint, not a fix.

Fix

Regenerate the lockfile so the optional platform set is complete — npm install --package-lock-only with the --os / --cpu overrides, or a full regeneration if that doesn't do it. Wants its own PR: verify the diff is additive (no version drift) and that npm ci is green on both npm 10 and 11.

Then drop the npm i -g npm@11 step and move the workflow to node 24 to match local dev.

Start with package-lock.json and the build-and-smoke workflow described in #172. Regenerate the lockfile using the stated platform overrides or full regeneration, then inspect that the diff is additive without version drift. Done means npm ci passes on Linux with npm 10 and 11, and the temporary npm 11 workaround is removed while the workflow uses Node 24.