ci: isolate staging dependency install

frontend/tests/staging-backend-workflows.test.ts

@@ -171,8 +171,8 @@ test("Gitea quality gate validates before publishing an immutable ACR manifest",
   assert.equal((workflow.match(/timeout 180 docker pull "\$NODE_TOOL_SOURCE_IMAGE"/g) ?? []).length, 2);
   assert.equal((workflow.match(/docker tag "\$NODE_TOOL_SOURCE_IMAGE" "\$NODE_TOOL_IMAGE"/g) ?? []).length, 2);
   assert.equal((workflow.match(/cat > "\$tool_dir\/node" <<'EOF'/g) ?? []).length, 1);
-  assert.equal((workflow.match(/--volume "\$workdir:\$workdir"/g) ?? []).length, 2);
-  assert.equal((workflow.match(/--workdir "\$workdir"/g) ?? []).length, 2);
+  assert.equal((workflow.match(/--volume "\$workdir:\$workdir"/g) ?? []).length, 3);
+  assert.equal((workflow.match(/--workdir "\$workdir"/g) ?? []).length, 3);
   assert.equal((workflow.match(/ln -s node "\$tool_dir\/npm"/g) ?? []).length, 1);
   assert.equal((workflow.match(/>> "\$GITHUB_PATH"/g) ?? []).length, 2);
   assert.match(workflow, /node:22-bookworm-slim "\$\{0##\*\/\}" "\$@"/);
@@ -182,6 +182,26 @@ test("Gitea quality gate validates before publishing an immutable ACR manifest",
   assert.match(workflow, /docker cp "\$container_id:\/usr\/local\/lib\/node_modules\/npm" "\$tool_dir\/npm-package"/);
   assert.match(workflow, /node --version \| grep -Eq '\^v22\\\.'/);
   assert.match(workflow, /npm --version/);
+  assert.match(
+    workflow,
+    /validate:[\s\S]*?env:\n\s+GITEA_SHA: \$\{\{ gitea\.sha \}\}\n\s+NODE_TOOL_SOURCE_IMAGE: swr\.cn-north-4\.myhuaweicloud\.com\/ddn-k8s\/docker\.io\/library\/node:22-bookworm-slim@sha256:ef343465b6a14bbdf2ab52f6e100ec0659a792464fcf72c462370d88b3df909c\n\s+NODE_TOOL_IMAGE: node:22-bookworm-slim[\s\S]*?- name: Prepare pinned Node tooling/,
+  );
+  const installStep = workflow.match(
+    /- name: Install dependencies[\s\S]*?(?=\n\s+- name: Validate backend, package, frontend, and database contracts)/,
+  )?.[0] ?? "";
+  assert.match(installStep, /workdir="\$\(pwd -P\)"/);
+  assert.match(installStep, /docker run --rm/);
+  assert.match(installStep, /--cpus=1\.5/);
+  assert.match(installStep, /--memory=2g/);
+  assert.match(installStep, /--memory-swap=2g/);
+  assert.match(installStep, /--pids-limit=256/);
+  assert.match(installStep, /--user "\$\(id -u\):\$\(id -g\)"/);
+  assert.match(installStep, /--volume "\$workdir:\$workdir"/);
+  assert.match(installStep, /--workdir "\$workdir"/);
+  assert.match(installStep, /--env HOME=\/tmp/);
+  assert.match(installStep, /--env "NPM_CONFIG_REGISTRY=\$NPM_CONFIG_REGISTRY"/);
+  assert.match(installStep, /"\$NODE_TOOL_SOURCE_IMAGE" \\\n\s+npm ci --prefix frontend \\\n\s+--no-audit \\\n\s+--no-fund \\\n\s+--progress=false \\\n\s+--maxsockets=4/);
+  assert.doesNotMatch(installStep, /--ignore-scripts|--omit(?:=|\s+)optional|--force/);
   assert.match(workflow, /docker compose version --short/);
   assert.match(workflow, /docker compose --help \| grep -q -- '--project-name'/);
   assert.match(