fix(examples): pin browser npm dependencies

[chaliy]

Motivation

• The browser example used a mutable latest dist-tag and ignored the generated lockfile, creating a supply-chain risk where future unreviewed npm contents could execute on developer machines or in the browser.
• Make the example reproducible and auditable so installs are locked to reviewed tarball integrity hashes and explicit version pins.

Description

• Pin @everruns/bashkit-wasm to 0.14.3 and vite to 6.4.3 in examples/browser/package.json and tighten the test script to run the new security check.
• Add a committed examples/browser/pnpm-lock.yaml and remove the lockfile entry from examples/browser/.gitignore so exact resolutions and integrity metadata are stored in the repo.
• Add examples/browser/dependency-security.test.js, a regression test that requires exact semantic versions and a committed lockfile.
• Update examples/browser/README.md to require pnpm install --frozen-lockfile and update specs/maintenance.md to mandate frozen-lockfile installs and an explicit review/update workflow for dependency bumps.

Testing

• The new regression test node --test dependency-security.test.js failed prior to the fix by detecting the latest specifier, demonstrating the detection works.
• Ran pnpm install --frozen-lockfile for the example which produced and validated the lockfile without errors.
• Ran pnpm test (the browser example tests), which passed all tests (8/8).
• Ran pnpm run build for the example and produced a successful Vite production build.

---

Codex Task

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	bashkit	556c938	Commit Preview URL	Jul 26 2026, 10:45 PM