Infra: pin matrix toolchain versions

[aqeelat]

Problem

The matrix used unpinned `npx --yes` commands, so local and CI runs could silently change when package latest tags moved.

Expected Behavior

Node dependencies and generator command packages are pinned, and CI installs from the lockfile.

Acceptance Criteria

• `package.json` and `package-lock.json` are committed
• CI uses `npm ci`
• Matrix runner invokes explicit package versions for npm-based tools