feat(ci): install Pi from the Kipp package's lockfile in setup-kipp

[pleb]

What

• setup-kipp now installs Pi from a lockfile that ships inside the Kipp package, instead of a global npm install of Pi from the registry. The package names that directory in kipp.piInstall.
• A Kipp release that does not declare kipp.piInstall now fails the action. Use the Kipp release that matches the setup-kipp pin.
• The Pi binary path is exported as KIPP_PI_BIN, and "Install Kipp into Pi" runs that binary.

Why

• The global install pinned only Pi's own version, so its dependency tree resolved fresh on every run. The lockfile pins the whole tree.
• The registry install is removed rather than kept as a fallback, so every run uses the pinned tree.

How

• kipp.piInstall must be a relative path that resolves inside the package and holds a regular package.json and package-lock.json, so the manifest cannot point the install elsewhere.
• Those two files are copied to a fresh RUNNER_TEMP directory and installed with npm ci --ignore-scripts. --min-release-age=0 stops a runner's release-age policy from refusing the locked releases.
• The step fails unless the installed pi --version matches kipp.supportedPiVersion.
• Installing from a lockfile removes the zizmor adhoc-packages exception this step needed before.

[github-actions]

🛡️ SHA Pinned Actions Report

✅ All 31 file(s) passed — actions are allowed and pinned as required.