Reconcile package.json with package-lock.json for npm ci

The v5.x lockfile carried newer versions than package.json declared —
a desync that lockless `yarn` never validated but `npm ci` (now used by
the lint job) rejects:

- @types/node: package.json 25.9.1 vs lock 25.9.2
- tmp: package.json 0.2.6 vs lock 0.2.7

Align package.json up to the already-locked versions rather than down:
tmp 0.2.6 carries a High-severity advisory (GHSA-7c78-jf6q-g5cm) and the
lock was already advanced to the fixed 0.2.7. This changes nothing about
what gets installed; it only makes the manifest honest. Regenerating the
lockfile also drops the stale root `hasInstallScript` flag (the install
script was removed in #363) and realigns the eslint-plugin-n / semver
range mirrors with package.json.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: szegedi

package-lock.json

@@ -42,7 +42,7 @@
   },
   "devDependencies": {
     "@types/mocha": "^10.0.1",
-    "@types/node": "25.9.1",
+    "@types/node": "25.9.2",
     "@types/semver": "^7.5.8",
     "@types/sinon": "^21.0.1",
     "@types/tmp": "^0.2.3",
@@ -58,7 +58,7 @@
     "semver": "^7.8.1",
     "sinon": "^22.0.0",
     "source-map-support": "^0.5.21",
-    "tmp": "0.2.6",
+    "tmp": "0.2.7",
     "typescript": "^6.0.3"
   },
   "files": [