chore(ci): drop unpinned global install of @nestjs/cli and nx

[karlkeppner1]

Found while auditing the workspace for exposure to the Shai-Hulud npm supply-chain attack (keyv and friends). No compromised packages were found in this repo — the lockfile is clean and so are the running pods.

1. Drop unpinned global install (the original change)

Removes npm i -g @nestjs/cli nx from the common-test workflow.

• Neither binary is ever invoked. The job's only commands are npm ci and npm audit.
• Neither package is a dependency. nx, @nestjs/cli, @nestjs/core are all absent from package.json. No nx.json, no nest-cli.json.
• No lifecycle scripts need them on PATH.
• It was unpinned and ran before npm ci, so it resolved both packages plus their full transitive trees fresh from the registry on every PR — outside the lockfile and outside the min-release-age=3 gate added in chore: gate npm installs by 3-day minimum release age #58.

2. Clear the three critical advisories

npm audit --audit-level=critical was already failing on chains/realio-testnet before this PR. I verified by auditing the unmodified base branch: 3 critical / 26 high / 60 total. It is unrelated to the workflow change — npm audit reads the local tree from the lockfile and never sees globally installed packages. It surfaced because the advisory database moved since the base last ran CI on 2026-06-30.

package	advisory	fix
tar <=7.5.20	GHSA-r292-9mhp-454m + others	override ^7.5.22
shell-quote <=1.8.4	command injection	override ^1.10.0
next 15.5.0	GHSA-9qr9-h5gf-34mp RCE in React flight protocol	^15.5.22

On next — no major upgrade needed

npm reports fixAvailable.isSemVerMajor: true for next, which suggests 16.x. That is an aggregate over every advisory filed against the package and is misleading here. The critical one is narrow — >=15.5.0-canary.0 <15.5.7 — and the lockfile sat at 15.5.0, just inside it. 15.5.22 clears every advisory listed (highest floor is <15.5.21) and already satisfied the declared ^15.2.1, so this is a lockfile bump within the existing range. package.json is raised to ^15.5.22 only to record the floor explicitly.

tar and shell-quote are both transitive, so overrides resolves them without touching direct dependencies.

Result

npm audit --audit-level=critical exits 0. Verified locally against the regenerated lockfile.

Follow-up (not in this PR)

min-release-age requires npm >= 11.10.0. This workflow pins node-version: 23, which ships npm 10.9.2 — so the .npmrc gate from #58 is currently inert in CI. It does apply in the Docker build, which upgrades npm first. Worth a separate PR to bump the runner's npm.