fix: use npm ci in bootstrap to prevent dirty lockfile blocking merges

setup.sh ran npm install which modified package-lock.json, causing
git merge to refuse during channel skill installation. Switch to
npm ci (deterministic, doesn't modify lockfile) and clean up stale
peer flags in the lockfile.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

setup.sh

@@ -79,8 +79,8 @@ install_deps() {
     log "Running as root, using --unsafe-perm"
   fi
 
-  log "Running npm install $npm_flags"
-  if npm install $npm_flags >> "$LOG_FILE" 2>&1; then
+  log "Running npm ci $npm_flags"
+  if npm ci $npm_flags >> "$LOG_FILE" 2>&1; then
     DEPS_OK="true"
     log "npm install succeeded"
   else