CI: hash-pin pip installs and lockfile-pin npm in verify.yml (supply-chain posture gap)

[27Bslash6]

Surfaced by the expert-panel security review on #53 (CWE-494/CWE-829, MAJ).

The verify workflow SHA-pins its GitHub Actions but installs Python/npm verification dependencies with version pins only:

• pip install cryptography==49.0.0 msgpack==1.2.1 lz4==4.4.5 — no --require-hashes, transitive deps (cffi, pycparser) fully unpinned, sdist fallback allowed.
• npm install --ignore-scripts @noble/hashes@2.2.0 — no lockfile/integrity (mitigated by --ignore-scripts and zero transitive deps).

Blast radius is capped by permissions: contents: read + persist-credentials: false: a poisoned release can falsify the verify signal (this repo's ratification gate for a fleet-wide crypto contract), not write to the repo. Low likelihood, but the posture explicitly aims higher — the actions are already SHA-pinned.

Fix (repo-wide, pre-existing — predates #53, which only appended lz4 to the existing unpinned line):

1. tools/verify-requirements.txt with --require-hashes + --only-binary :all: (transitives included), used by the optional-deps step.
2. Committed package-lock.json + npm ci for the JS cross-check step.
3. Check Renovate interplay so the pins stay maintained.