PFM-ISSUE-34453 - github-actions: Normalize package-lock.json resolved URLs onto the JFrog npm proxy (release/26.2)

[Kaltenbach]

What this is

Branch 5 of 7 for PFM-ISSUE-34453. Normalizes this branch's package-lock.json resolved URLs onto the JFrog
npm proxy, and adds the same lockfile tooling and PR guard.

The tooling is byte-identical to the seed (#163,
merged) — verified, not asserted:

sha1(tools/scripts/lockfile/* + pr-checks.yml + use-npmrc/action.yml + .prettierignore) = f28f73029d4cb426

Same on all seven branches. So the only thing needing review here is the lockfile commit, and that is machine-checked.
The substantive review happened on #163.

Note on the digest. release/25.2 currently reads 4aa3bcb389875d53 because
#164 — a wording-only correction to the advisory
message and the docs — is still open. These six already carry it. Merging #164 closes the gap; nothing else differs.

Two commits

1. Tooling, copied verbatim from the seed.
2. The normalized lockfile alone. Its parent is the baseline, so the invariant is provable by construction:
   ./tools/scripts/lockfile/check-lockfile.sh --baseline HEAD~1.

Evidence

• 171 entries rewritten, +4788 bytes (270244 → 275032), 342 changed lines, 0 outside a "resolved" line
• grep -c registry.npmjs.org package-lock.json → 0 (558 entries total)
• check-lockfile.sh --baseline HEAD~1 exits 0: graph identical to the baseline, exactly one registry prefix
• bats 74/74 and shellcheck clean, both in CI via pr-checks.yml

Why this matters now

The prefix-drop that motivates this is a regression in newer npm, measured 2026-08-14: npm 10.2.4 — which every
pipeline pins today via node 18.19.1 — rewrites correctly and resolves through the proxy, while npm 11.3.0 drops the
registry's path prefix and fails with an E404 masked as ***. So nothing is failing in CI today, and everything
un-normalized fails the moment runners move to node 24. This is a prerequisite for that migration, not a cleanup
after it.

Known limitation, same as #163: the guard reports but cannot block until PFM-ISSUE-34465 (Rule Sets enforcement)
lands.

[Benno42]

LGTM