build: use npm ci for clean, reproducible installs (#839)

Switch pr-build and the Docker image from `npm install` to `npm ci` (`npm ci --omit=dev` in the image), and enable setup-node's npm cache. Deterministic installs from the committed lockfile; CI now fails fast on an out-of-sync lockfile.

Depends on the lockfile being tracked (PR #838) — npm ci requires a committed package-lock.json.

.github/workflows/pr-build.yml

@@ -22,9 +22,10 @@ jobs:
         uses: actions/setup-node@v4
         with:
           node-version: '20'
+          cache: 'npm'
 
       - name: Install dependencies
-        run: npm install
+        run: npm ci
 
       - name: Lint MDX heading hierarchy
         run: npm run lint:mdx