ci: lock jest-junit instead of installing it ad hoc

[shauneccles]

Problem

CI and the release workflow install jest-junit with npm install --no-save after npm ci. That resolves an unreviewed package version outside package-lock.json in every run, including the tag-triggered publish path.

Change

• add jest-junit to devDependencies and the lockfile
• remove all three ad-hoc installation commands
• leave the existing Jest reporter and test commands unchanged

Verification

• clean npm ci
• npm ls jest-junit --depth=0 resolves 17.0.0
• CI-mode Node 24 Jest run passed: 25 tests
• zizmor no longer reports adhoc-packages in ci.yml or publish.yml
• root npm audit reports 0 vulnerabilities
• git diff --check passed

This is independent of #9524, though both touch nearby lines in publish.yml; I can rebase whichever lands second.