CI: gc-root-dominance-statepoints red on main and every PR since #8084 — the statepoints job never runs npm ci #8170

Summary

gc-root-dominance-statepoints has failed on every main run since #8084
merged, and it fails on every PR, with:

##[error]node_modules/zod/src/index.ts is missing; run npm ci --ignore-scripts
##[error]Process completed with exit code 2.

The sibling job gc-root-dominance passes in the same run.

Cause

.github/workflows/gc-root-dominance.yml has two jobs. Only one of them
installs the dependency the corpus compiles:

#8084 (53d63aad2, merged 2026-08-15T12:25Z) added the dependency-scale native
corpus to the statepoints job. That script needs node_modules/zod, and the
two setup-node / npm ci steps that make it available live in the other job.
The first main run after that merge (d6d7d0efe, 13:00Z) is the first failure
of this kind; the two fa83ecab2 runs at 06:29Z and 06:59Z were green.

(The job was also red for a different reason on 2026-08-14 — could not read STATEPOINT_REWRITE_PASSES out of crates/perry-codegen/src/inprocess.rs — which
was fixed before this one started. Worth knowing when reading run history.)

Why it matters beyond the red X

This is the CLAUDE.md failure mode #2/#4 combined. The statepoints arm is the
one that covers the shipped lowering — RS4GC statepoints are the default on
aarch64 and x86-64 — and it is currently unable to report anything about root
dominance at all, because it dies in setup before the checker runs. Its green
sibling covers the shadow-frame arm. So the gate that looks like it is watching
the default configuration has been watching nothing since yesterday lunchtime,
while main kept moving.

It also red-lights every open PR, which trains reviewers to ignore the check —
the same dynamic #8092 describes for lint and cargo-test.

Fix

Copy the two steps from the gc-root-dominance job into
gc-root-dominance-statepoints, before the corpus step:

      - uses: actions/setup-node@v6
        with:
          node-version-file: .node-version
      - name: Install the npm dependencies the dep corpus compiles
        run: npm ci --ignore-scripts --no-audit --no-fund

Worth also making gc_root_dominance_dep_native_corpus.sh's precondition check
say which job is missing the install, since the current message ("run npm ci
--ignore-scripts") reads like operator error rather than a workflow gap.

Noticed on #8165, whose only red check this is.