fix(ci): repair two pre-existing workflow failures (verify-specs + wasm-size)

[brawlaphant]

Summary

Two pre-existing bugs in the CI workflow YAMLs have been producing red check marks on every PR regardless of content. This PR fixes both with a ~14 line diff across two YAML files.

• Lands in: `.github/workflows/ci.yml`, `.github/workflows/wasm-size.yml`
• Changes: remove broken `npm ci` step in verify-specs; pass wasm-size report via env var instead of template substitution
• Validate: `node scripts/verify.mjs` (bug 1); wasm-size bug 2 end-to-end on this PR's own CI

Bug 1: `verify-specs` runs `npm ci` at a root with no lockfile

`.github/workflows/ci.yml` verify-specs job runs:

```yaml

• name: Install root dependencies
  run: npm ci
  ```

The repository root has a `package.json` (declaring only `scripts`, zero dependencies) and no `package-lock.json`. `npm ci` strictly requires a lockfile even when there's nothing to install:

```
npm error code EUSAGE
npm error The `npm ci` command can only install with an existing
npm error package-lock.json or npm-shrinkwrap.json with
npm error lockfileVersion >= 1.
```

The actual work in this job is `node scripts/verify.mjs`, which only imports `node:fs`, `node:path`, and `node:child_process`. No external dependencies. Fix: remove the step entirely.

Bug 2: `wasm-size` can't substitute a multi-line report into a JS string literal

`.github/workflows/wasm-size.yml` uses `actions/github-script@v7` with this pattern:

```yaml
script: |
...
'${{ steps.sizes.outputs.report }}',
...
```

GitHub Actions substitutes the value into the JavaScript source text before execution. The report is a multi-line Markdown table (one row per contract). When the multi-line text is inlined into a JavaScript single-quoted string literal, the literal ends at the first newline and everything after becomes invalid JS:

```
SyntaxError: Invalid or unexpected token
at new AsyncFunction ()
...
```

Fix: pass the report via an `env:` map instead of template substitution. `actions/github-script` exposes the job's env to the script via `process.env`, so the multi-line string survives as an opaque runtime value:

```diff

• name: Comment on PR
  uses: actions/github-script@v7

• env:
• REPORT: ${{ steps.sizes.outputs.report }}
  with:
  script: |
  ...

•  '\${{ steps.sizes.outputs.report }}',
  

•  const report = process.env.REPORT || '(no report)';
  

•  ...
  

•  report,
   ...
  

```

This is the pattern `actions/github-script` documents for untrusted or multi-line inputs.

Scope

Two YAML files. No TypeScript, no Rust, no reference-impl changes.

Related

Part of the CI-repair sweep alongside #90 (contracts clippy + 3 orphaned workspace members) and #91 (`agents/` `workspace:*` protocol). Together these three PRs should clear every CI failure on every open PR.

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

[brawlaphant]

Superseded by #106 which combines this fix with #90 and #91 into a single green-CI PR. The three standalone fix PRs each leave 2-3 other CI jobs failing; #106 fixes all four in one shot.

Suggest closing this once #106 lands.

[glandua]

Superseded by #106, which combined the fixes from this PR with the others needed to make all 4 CI jobs go green. #106 has been merged.