Harden reproducible builds and directory regression coverage

[den-sq]

Closes #12.

Summary

• track the npm lockfile and standardize builds on Node 24 with npm 11.19
• update Vite and related dependencies, and use npm ci throughout CI
• add regression coverage for directory request correlation and backend error responses
• smoke-test both Vite entry points and validate release manifests and ZIP archives
• run regression and release builds on Ubuntu and Windows
• document the Ouroboros integration smoke test used for release qualification

Verification

• npm test (8 tests)
• npm audit --audit-level=moderate (0 vulnerabilities)
• npm run smoke:dev
• npm run build:release
• npm run validate:release
• npm run validate:archive -- dist/neuroglancer-plugin-v1.1.0-ci.zip
• full locked build/test suite in the official node:24-bookworm container

Remaining release checks

• confirm the Windows CI matrix job
• run the documented interactive Ouroboros directory-selection smoke test against the release candidate

[tavateva]

Reviewed against the standard PR approval criteria and issue #12's acceptance criteria. The implementation is complete and I verified it locally — approving the code. One acceptance item (#12 AC8, the Ouroboros integration smoke) remains and is the single gate before this should close #12; details at the end.

Verified, not inferred. I ran tests/directoryRequests.test.ts in a fresh Node 24.16 checkout (built-ins only, no install) — 8 passed, one per AC4 case. I then probed the extracted parse on inputs the tests don't cover: a non-string path → null, malformed (array) nodes → {}, an unknown error code (throttled) → nodes preserved, a fatal code (denied) → {}. All behave as designed.

The refactor is behavior-preserving — the part with no direct test. I traced index.tsx request-build and response-handling against the extracted module line by line:

• request: createDirectoryContentsRequest(nextPath, ++counter) produces byte-identical {type, data:{path, recursive:true, requestId:"loadfile-N"}} and the same activeRequestIdRef assignment.
• response: parse preserves the requestId-correlation guard; apply preserves the directoryPath === response.path guard and the immutable merge. The two edges that differ — non-string path and non-record nodes — are strictly safer in the new code (old ?? {} would pass a malformed nodes through; old path-mismatch would no-op one step later), so there's no regression. Type exports are re-exported from index.tsx, so external importers of DirectoryData/NodeChildren/FileSystemNode don't break.

Acceptance criteria 1–7, each confirmed:

• AC1/AC2 (lockfile + toolchain): package-lock.json tracked (the +3660), .gitignore entry removed, package.json declares engines.node >=24 / npm 11.19.0 and packageManager: npm@11.19.0; CI uses npm ci. Green on both OS matrices.
• AC3 (Dependabot): deps are the patched targets from the issue — vite@^6.4.3, vite-plugin-static-copy@^2.3.2, @vitejs/plugin-react@^4.7.0. (I confirmed the versions match the required upgrades; I did not run npm audit myself — the body reports 0 moderate+ and CI covers it.)
• AC4 (protocol regression): the extracted module + 8 tests cover matching, stale/missing, mismatched-path, denied/not-found/internal, and partial-limit — the exact five behaviors, behavior-asserted. Ran them; all pass.
• AC5 (both entry points): smoke:dev hits / and /ngrefactor.html; the manifest validator additionally cross-checks each HTML's referenced assets/* exist in dist.
• AC6 (release validation): validate-release-manifest.mjs asserts the copied backend/package resources (Dockerfile, requirements.txt, app/main.py, compose, icon) and the archive-root plugin-release.json metadata; validate-release-archive.mjs integrity-tests the zip and compares the archived manifest against the built one — validating the final archive, not just dist. Genuinely thorough.
• AC7 (Ubuntu + Windows CI): regression (ubuntu-latest), regression (windows-latest), and plugin-artifact are all green. The "confirm the Windows CI matrix" item in the body is satisfied by the passing windows-latest run.

Scope is clean: the large diff is the lockfile; the ESLint backlog is correctly left out of scope per the issue, and CI gates on regression/artifact rather than the full lint, while the new protocol code is scoped-typechecked (typecheck:test).

The one gate — AC8 (Ouroboros integration smoke). Issue #12 requires "a plugin build is smoke-tested against current Ouroboros main for recursive directory discovery and rapid root switching," and the PR lists it under "Remaining release checks" — it hasn't been run. Under the acceptance criteria a live-verification item shouldn't merge deferred, so I'm flagging it explicitly rather than waving it through. Two mitigating facts: it's genuinely interactive/environment-gated (a running Ouroboros instance + manual directory operations — not CI-able, and I can't run it), and the automated protocol tests here directly exercise the correlation/stale/rapid-switch logic the smoke would confirm, so the smoke is confirmatory, not the sole safety net. Recommendation: run the documented Ouroboros smoke against the release candidate and report the result before this merges-and-closes #12 — or, if you prefer to land the hardening first, keep #12 open (or file a follow-up) tracking that one interactive check rather than auto-closing it.

Limit: static review + local test/edge execution (8 tests + parse probes on Node 24); I did not run npm ci/build/audit/the release-validation scripts end-to-end — CI's green ubuntu+windows+artifact jobs cover those. The code is approve-worthy; AC8 is the outstanding acceptance item.