Verify npm dependency signatures before builds (#1027)

CI installs the locked npm dependency tree without running lifecycle
scripts, but it does not verify registry signatures or available
provenance attestations. Run `npm audit signatures` after installation
in both the test and checksum-update workflows, before `npm run all`
executes dependency tooling. The check follows npm's registry-signature
support and verifies attestations when present; it does not require
every dependency to publish provenance.

Related: astral-sh/ruff-action#402 adds the same signature and
provenance verification. astral-sh/setup-uv#1026 separately hardens
`npm` install defaults.

Co-authored-by: zaniebot <242828183+zaniebot@users.noreply.github.com>

.github/workflows/test.yml

@@ -34,6 +34,8 @@ jobs:
           cache: npm
       - run: |
           npm ci --ignore-scripts
+      - name: Verify npm package signatures
+        run: npm audit signatures
       - run: |
           npm run all
       - name: Check all jobs are in all-tests-passed.needs

.github/workflows/update-known-checksums.yml

@@ -38,7 +38,10 @@ jobs:
           fi
       - name: Compile changes
         if: ${{ steps.changes-exist.outputs.changes-exist == 'true' }}
-        run: npm ci --ignore-scripts && npm run all
+        run: |
+          npm ci --ignore-scripts
+          npm audit signatures
+          npm run all
       - name: Create Pull Request
         if: ${{ steps.changes-exist.outputs.changes-exist == 'true' }}
         uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1