fix(plugin): install the client build's deps with npm ci

npm install reuses whatever the cache and an earlier run left behind and still
reports success, so a truncated cache entry produced a node_modules that was
missing typescript's lib/*.d.ts — the build then died with TS2318, every global
type undefined. npm ci starts from an empty tree and verifies each tarball
against the lockfile's integrity hash. Falls back to install when the copied
client has no usable lockfile.

scripts/plugin-open.js

@@ -41,9 +41,17 @@ function run(cmd, args, cwd, stdio) {
  * caller's stdio — used when this runs inside the detached bootstrap worker,
  * whose own stdout is discarded, so a build failure is still debuggable.
  *
+ * `exec` is the command runner, swappable for tests.
+ *
  * @returns {"ready"|"built"|"failed"}
  */
-function buildClient({ rt = boot.runtimeDir(), root = PLUGIN_ROOT, force = false, logPath } = {}) {
+function buildClient({
+  rt = boot.runtimeDir(),
+  root = PLUGIN_ROOT,
+  force = false,
+  logPath,
+  exec = run,
+} = {}) {
   const dist = path.join(rt, "client-dist");
   if (!force && fs.existsSync(path.join(dist, "index.html"))) return "ready";
 
@@ -57,8 +65,22 @@ function buildClient({ rt = boot.runtimeDir(), root = PLUGIN_ROOT, force = false
       filter: (p) => !/[\\/](node_modules|dist)$/.test(p),
     });
 
-    if (!run(NPM, ["install", "--no-audit", "--no-fund"], src, stdio)) return "failed";
-    if (!run(NPM, ["run", "build"], src, stdio)) return "failed";
+    // `npm install` reuses whatever the cache and a previous run left behind and
+    // still reports success, so a truncated cache entry or an interrupted install
+    // yields a tree that is missing files nobody notices until `tsc` dies with
+    // TS2318 (every global type gone, because typescript's own lib/*.d.ts never
+    // landed). `npm ci` starts from an empty node_modules and checks every
+    // tarball against the lockfile's integrity hash, so a bad cache entry is
+    // refetched instead of silently reused. It needs a lockfile that matches
+    // package.json — fall back to `install` when the copy has none or has drifted.
+    const npmFlags = ["--no-audit", "--no-fund"];
+    if (
+      !exec(NPM, ["ci", ...npmFlags], src, stdio) &&
+      !exec(NPM, ["install", ...npmFlags], src, stdio)
+    ) {
+      return "failed";
+    }
+    if (!exec(NPM, ["run", "build"], src, stdio)) return "failed";
 
     fs.rmSync(dist, { recursive: true, force: true });
     fs.cpSync(path.join(src, "dist"), dist, { recursive: true });