the screenshot audit installs playwright by pinned version through npx with no lockfile; a committed lockfile would harden it but changes wrangler-action's package-manager inference and needs the dependency gate

the screenshot audit installs playwright by pinned version through npx with no lockfile; a committed lockfile would harden it but changes wrangler-action's package-manager inference and needs the dependency gate

Remedy grounds (2026-09-29)

• npm ci requires the lockfile, exits on any disagreement with package.json and never rewrites it (https://docs.npmjs.com/cli/v10/commands/npm-ci, consulted 2026-09-29); wrangler-action infers its package manager from a lockfile in its workingDirectory and takes an explicit packageManager input (https://github.com/cloudflare/wrangler-action, consulted 2026-09-29), so a subdirectory lockfile hardens the transitive tree without touching the deploy job.
• Rejected: a root lockfile, the placement that changes the deploy job's inference.