fix(ci): isolate npm install caches

.gitea/workflows/ci-deploy.yml

@@ -54,8 +54,6 @@ jobs:
         uses: actions/setup-node@v4
         with:
           node-version: '20'
-          cache: 'npm'
-          cache-dependency-path: job-tracker-ui/package-lock.json
 
       - name: Test repository safety scripts
         # Standard-library only and plan-only: this validates the synthetic benchmark harness
@@ -118,12 +116,15 @@ jobs:
         run: |
           node -v
           npm -v
-          # npm ci occasionally segfaults on the runner (SIGSEGV/139, a memory/native
+          # The runner's shared npm cache has returned checksum-invalid tarballs and
-          # flake). Retry once with a clean node_modules before failing the job.
+          # injected control bytes into installed JS. Give each attempt an isolated
-          npm ci --no-audit --no-fund \
+          # cache so a poisoned archive cannot survive into this checkout or retry.
+          npm_cache="$(mktemp -d)"
+          npm ci --no-audit --no-fund --cache "$npm_cache" \
             || ( echo "npm ci failed ($?) — cleaning node_modules and retrying once..." \
                  && rm -rf node_modules \
-                 && npm ci --no-audit --no-fund )
+                 && npm_cache="$(mktemp -d)" \
+                 && npm ci --no-audit --no-fund --cache "$npm_cache" )
 
       # Moderate React Router advisories remain documented and mitigated; high/critical findings
       # in either production or test/browser tooling block the build.
@@ -156,8 +157,8 @@ jobs:
 
           echo "Browser smoke failed ($smoke_status) — rebuilding the browser runtime and retrying once..."
           rm -rf node_modules
-          npm cache verify
+          recovery_cache="$(mktemp -d)"
-          npm ci --no-audit --no-fund --prefer-online
+          npm ci --no-audit --no-fund --cache "$recovery_cache"
           npx playwright install --with-deps --force chromium
           npm run test:e2e