Packaging build fetches an unpinned tool from npm and rewrites a tracked lockfile

[antoinevalentinHA]

web-ui/pom.xml declares a yarn-update-browserslist execution which runs the npm script update-browserslist:

"update-browserslist": "npx browserslist@latest --update-db"

Three consequences, in order of how much they matter:

• The release build resolves @latest from npm at build time. mvn package runs this execution, and .github/workflows/maven.yml runs mvn -B package to produce the archive attached to a release. The packaging path invokes npx browserslist@latest --update-db, so the build resolves an unpinned npm package at build time.
• It rewrites the tracked web-ui/javascript/yarn.lock, by design: --update-db removes and reinstalls caniuse-lite. A packaging build therefore leaves the working tree dirty.
• No CI check can observe either. The job that runs git diff --exit-code passes -Dskip.installnodeyarn=true -Dskip.yarn=true, so the frontend goals never execute there; the Web UI job runs yarn install --frozen-lockfile and the test suite, not mvn package.

Reported by @lgnap in #43, as an aside to that PR. The mechanism and the CI blind spot are confirmed; the lockfile rewrite is his observation and has not been reproduced here.

Not decided: whether to pin the tool, drop the execution, or run it deliberately and commit the result. Whatever the answer, a packaging build should not resolve @latest.