ci: pin the three remaining check jobs to --frozen-lockfile

[iceteaSA]

Closes #295. One-line change ×3, off clean master @ 328c0fdc.

check-plugin (48), check-pi-plugin (104), check-dashboard (129) → bun install --frozen-lockfile, matching the four later jobs.

Verification

On a clean upstream/master worktree:

• bun install --frozen-lockfile succeeds — 1447 packages, exit 0. The lockfile is consistent with the manifests, so pinning does not break the install.
• The resulting node_modules resolves biome 2.5.1 — the version biome check . actually executes — rather than the floated 2.5.7.
• Repo-wide bun run lint passes under the pinned install.

One detail worth recording, since it nearly misled me: bunx @biomejs/biome --version reports 2.5.7 even after a frozen install, because bunx resolves from the registry rather than node_modules. The lint scripts run biome check . through the package's local binary, which is 2.5.1. So a bunx probe is the wrong instrument here — ./node_modules/.bin/biome --version is the one that reflects what CI runs.

Tradeoff

As discussed on the issue: this gives up the incidental early-warning property of floating installs, in exchange for reproducible CI and toolchain upgrades landing as explicit lockfile commits. Flagging it in the commit message too so the reasoning is discoverable from git log and not only from the issue thread.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

---

Summary by cubic

Pins the check-plugin, check-pi-plugin, and check-dashboard CI jobs to use bun install --frozen-lockfile. This prevents dependency drift (e.g., @biomejs/biome 2.5.7 vs 2.5.1) and makes CI installs reproducible, addressing #295.

^{Written for commit c0c63cb. Summary will update on new commits.}

Greptile Summary

This PR makes the remaining three CI check jobs install dependencies from the committed Bun lockfile, preventing unreviewed dependency drift.

• Adds --frozen-lockfile to dependency installation in check-plugin.
• Applies the same reproducible installation behavior to check-pi-plugin and check-dashboard.
• Aligns these checks with the repository's existing end-to-end CI jobs.

Confidence Score: 5/5

The PR appears safe to merge because all three affected jobs can install from the consistent committed lockfile.

The change only enables Bun's frozen-lockfile enforcement for three root workspace installs, with no intervening manifest mutation and with equivalent frozen installs already used by sibling CI jobs.

Important Files Changed

Filename	Overview
.github/workflows/ci.yml	Pins dependency installation in three check jobs to the committed Bun lockfile; the lockfile and workspace manifests are consistent and no changed-code failure was identified.

_{Reviews (1): Last reviewed commit: "ci: pin the three remaining check jobs t..." | Re-trigger Greptile}

[cubic-dev-ai]

No issues found across 1 file

_{Re-trigger cubic}