chore(ci): add sfw security scanning via socket-registry install action

[John-David Dalton (jdalton)]

Replaces bare pnpm install --frozen-lockfile with the shared socket-registry install action (with frozen-lockfile: true), which injects sfw-free shims for all supported package managers before install. No other changes — checkout, pnpm setup, and node setup are unchanged.

---

Note

Medium Risk
CI behavior changes by delegating dependency installation to an external shared action, which could affect reproducibility and introduce workflow regressions if the action behavior changes. Documentation-only edits are low risk but won’t mitigate install-action issues if misconfigured.

Overview
CI workflows now install dependencies via the shared SocketDev/socket-registry install action (with frozen-lockfile: 'true') instead of running pnpm install --frozen-lockfile directly, across ci.yml, provenance.yml, and weekly-update.yml.

Updates internal Claude skill documentation: trims the quality-scan version line metadata, corrects the expected tool count output in updating-checksums, and adds new reference docs for updating and updating-checksums.

^{Written by Cursor Bugbot for commit c05d5ee. Configure here.}