Install Context Room dependencies in CI

[Swarek]

Summary

• commit the npm lockfile for the existing ws runtime dependency
• run npm ci before the Node 20/22 test matrix
• pin the companion Codex prompt runtime to its immutable v1.0.0 release

Validation

• npm ci: OK
• npm test: 313 passed
• npm run package:privacy: OK (46 files)
• git diff --check: OK

This follows up PR #2, whose Node 22 job exposed that the workflow never installed dependencies.