ci: pin npm to 11 so Dependabot lockfiles pass CI

[dhensby]

Problem

Every Dependabot PR in this repo currently fails CI at npm ci:

npm error `npm ci` can only install packages when your package.json and
package-lock.json or npm-shrinkwrap.json are in sync.
npm error Missing: conventional-commits-filter@6.0.1 from lock file

This is not caused by any of the bumps themselves — the missing package is unrelated to the dependency being updated in each case. It currently blocks #271, #272 and #273, and will block every future Dependabot PR until it is fixed.

Cause

@conventional-changelog/git-client@3.1.0 declares conventional-commits-filter as an optional peer dependency:

"peerDependencies": { "conventional-commits-filter": "^6.0.1" },
"peerDependenciesMeta": { "conventional-commits-filter": { "optional": true } }

npm 10 and npm 11 disagree about what to do with that:

	behaviour
npm 10	records a nested conventional-commits-filter@6.0.1 under @commitlint/read, then requires it to be present in npm ci
npm 11	omits it entirely

.nvmrc pins Node 22, which ships npm 10.9.8. Dependabot regenerates lockfiles with npm 11. So Dependabot produces a lockfile that is internally consistent but that CI's older npm rejects.

@dependabot rebase doesn't help — it correctly reports the branches are already up to date with master. @dependabot recreate rebuilds them from scratch and reproduces exactly the same lockfile.

Fix

1. Pin npm to 11 in CI, so lockfiles are validated by the same major version that generates them.
2. Regenerate package-lock.json with npm 11, so the committed lockfile matches what Dependabot produces (this is the 12-line deletion).

actions/checkout@v3 and actions/setup-node@v3 were also being force-migrated to Node 24 with a deprecation warning on every run, so they go to v7 here too.

Verification

Reproduced and verified locally on Node 22 / npm 11:

• Regenerating the lockfile under npm 11 produces exactly the lockfile Dependabot generates — a zero-byte diff against chore(deps-dev): bump fast-uri from 3.1.5 to 3.1.7 #273's branch.
• npm ci then succeeds (486 packages).
• npm run lint — clean.
• npm run test:workflow — 27 passing, 0 failing.

The two commits are ordered so each is independently green: the npm pin lands first (npm 11 accepts the existing npm 10 lockfile, since surplus entries are not an error), and the regenerated lockfile follows.

Once this merges, #271, #272 and #273 need a @dependabot recreate to pick up the new base.